CSS: the bomb inside your inbox
Analytics2026-08-07, 13:35
In their new article, PortSwigger researchers showed that modern CSS in HTML emails can be used not only to style interfaces, but also as an attack tool. They analyzed Gmail, Outlook, Fastmail, ProtonMail, Yahoo, and AOL, demonstrating several ways to abuse CSS capabilities in email clients where JavaScript is blocked.
Data exfiltration via CSS
Using CSS selectors and external requests, attackers can gradually extract individual pieces of data from a page. In Yahoo/AOL, the researchers managed to extract a Medium login token from an email draft.
In Gmail and Fastmail, they also managed to trigger repeated requests from the email to an external server, despite the use of image proxy mechanisms.
Attacks on AI agents
Through hidden CSS elements and quirks in HTML processing, some AI agents may interpret email content differently from the user.
In one PoC, hidden instructions prompted an AI agent to access confidential data in the email, after which the data could be exfiltrated via CSS.
A JavaScript-free keylogger in Outlook
The most striking PoC showed that a CSS gadget, :has(), :checked, and Firefox-specific behavior can be used to create a fake login form inside Outlook and track the characters entered by the user in near real time.
The research shows how significantly the capabilities of attacks through HTML email content have expanded. The boundary between «static» content and executable logic is becoming increasingly blurred: even without JavaScript, CSS can be used for data exfiltration, interface manipulation, and influencing AI agents. Therefore, filtering dangerous HTML constructs alone is no longer sufficient — an architectural separation of untrusted content from the email client's data and interface is required.
Vendors
Products
More