CSS:the bomb inside your inbox
Refract AI Intelligence Digest
BLUF
Flaws in CSS sanitization within webmail clients enable attackers to exfiltrate sensitive data via malicious stylesheets.
NEWS
PortSwigger Research reveals that common webmail clients incorrectly render untrusted CSS within trusted UI contexts despite sanitization efforts. Gareth Heyes demonstrates how these bypasses allow for significant security breaches in email environments.
Why I Care
This impacts all users of web-based email services, as attackers can silently harvest credentials or internal data without triggering traditional XSS protections.
Next Steps
Email providers must audit and update CSS sanitization libraries immediately, while users should enable advanced security settings until patches are deployed.
Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this
Source: PortSwigger Research ·