CSS-based Email Attacks Can Bypass Security to Steal Passwords
New research reveals that malicious styles embedded in emails can function as keyloggers without requiring JavaScript.
A critical vulnerability in how webmail clients handle styling allows attackers to exfiltrate sensitive data and steal passwords using only HTML and CSS. PortSwigger researcher Gareth Heyes demonstrated that malicious CSS embedded in emails can break out of trust boundaries to interfere with webmail interfaces, bypassing the primary security defenses that typically block executable scripts.
According to research published by PortSwigger on August 6, 2026, titled "CSS: the bomb inside your inbox," these attacks can be used to exfiltrate tokens, compromise third-party websites, and steal user credentials. Because the attacks rely solely on HTML and CSS, they require no JavaScript or attachments to function. Heyes noted that the combination of these two languages is now powerful enough to build a working keylogger, stating, "It's almost like a programming language now."
The Sanitization Gap
Webmail clients generally render untrusted email content within a trusted user interface. To prevent malicious code from affecting the rest of the page, vendors rely on CSS sanitization to strip out dangerous properties. However, as modern browsers introduce increasingly complex CSS and HTML features, the attack surface expands. Researchers have found ways to "hotwire" these new design properties and animations to leak data from the page, effectively circumventing the sanitization boundaries intended to isolate the email content.
A Shift in Email Security
This discovery represents a significant shift in the threat landscape because it renders traditional JavaScript-based defenses obsolete in this context. Most security models assume that blocking scripts is sufficient to prevent active attacks within an inbox. However, since users cannot disable CSS without completely breaking the visual experience of the web, the responsibility for security shifts entirely to the vendors. To mitigate these risks, providers must implement near-perfect sanitization or move toward strict isolation, such as sandboxing email content in separate environments.
Future Outlook
As browser capabilities continue to evolve, the potential for new CSS-based exfiltration techniques remains high. Security teams are now tasked with monitoring how new web standards might be weaponized to leak data. While the core research confirms the viability of these attacks, the industry must now determine the full extent of the vulnerability across various webmail platforms and develop more robust isolation strategies to protect user credentials.