CSS Vulnerabilities Allow Attackers to Steal Passwords via Webmail

Security researcher Gareth Heyes of PortSwigger has uncovered a series of vulnerabilities that allow attackers to weaponize CSS to steal sensitive data from webmail users. By bypassing CSS sanitization filters, attackers can break out of trust boundaries to exfiltrate passwords and session tokens directly from a user's browser.

The attack functions by using CSS selectors and external requests to extract data from a page piece-by-piece. Unlike traditional phishing or malware attacks, this method requires neither JavaScript nor file attachments to operate. To demonstrate the severity of the flaw, researchers successfully extracted a Medium login token from an email draft within Yahoo and AOL mail interfaces.

The Failure of Sanitization

Webmail clients typically render untrusted HTML and CSS from incoming emails within a trusted user interface. To prevent Cross-Site Scripting (XSS) and other exploits, these providers employ CSS sanitization to strip out dangerous code. However, the increasing complexity of modern CSS has introduced "gadgets" that can bypass these filters.

As Heyes noted, it is common for webmail clients to render untrusted CSS in a trusted UI, which creates an opening to break trust boundaries and compromise third-party websites. Because CSS is primarily viewed as a presentational language, it has historically faced less scrutiny than JavaScript, allowing these exfiltration techniques to remain overlooked.

Industry Implications

This discovery represents a critical failure in the "defense-in-depth" strategy used by major webmail providers. For years, the security industry has operated under the assumption that disabling JavaScript in email rendering effectively neutralized the risk of active browser-based attacks. This research renders those assumptions obsolete, proving that a purely presentational language can be transformed into a powerful tool for data theft.

The ability to steal tokens and passwords through a simple email means that users are at risk even if they follow standard security hygiene, such as avoiding suspicious attachments or scripts. The vulnerability turns the very layout engine of the browser into a weapon against the user.

What to Watch

While the research highlights specific failures in Yahoo and AOL, the underlying issue of CSS sanitization is a systemic challenge for any service that renders rich-text content. The industry must now determine if other major webmail providers are susceptible to similar CSS-based exfiltration.

Security teams are expected to move toward more restrictive CSS policies or implement stricter isolation between the email content and the surrounding browser UI. Until these patches are standardized, the risk remains that a carefully crafted stylesheet can act as a "bomb" inside a user's inbox, silently leaking data to a remote server.