A new class of email-based attacks that exploit ordinary CSS styling code to hijack webmail interfaces, spy on user activity, and even steal passwords in real time, all without relying on JavaScript or traditional malware.
Dubbed “CSS bomb” attacks, the technique weaponizes trusted formatting features found in nearly every major webmail platform, turning a routine HTML email into a stealth keylogger capable of capturing credentials as victims type them.
The PortSwigger researcher Gareth Heyes examined how webmail clients such as Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail sanitize incoming HTML and CSS before rendering it.
These sanitizers are meant to strip out dangerous code while still allowing emails to display fonts, colors, and layouts correctly. The researchers found that discrepancies between what a sanitizer considers safe and what a browser actually renders open the door to abuse.
CSS Bomb Attack
By exploiting quirks such as CSS mutation, attribute selectors, and pseudo-elements like :before, :after, :has(), and :checked, attackers can manipulate select-menu dropdowns to mimic password fields. When a victim types into what looks like a login box, each keystroke triggers a unique CSS rule that silently sends a background image request to an attacker-controlled server, effectively logging every character typed.
Earlier CSS keylogger concepts were largely theoretical because browsers do not update HTML attributes when a user types into a real input field.
The new research bypasses this limitation entirely by hijacking select elements and HTML labels instead, creating a fully functional, real-time password-stealing mechanism that works even in emails protected by strict sanitizers like DOMPurify.
Gareth Heyes demonstrated working exploits against Outlook, where a CSS “gadget” bug allowed attackers to break out of the email window entirely and spoof a convincing fake Microsoft login screen. In Fastmail, a technique called CSS hotwiring let attackers hijack any click on the page to trigger unintended actions, while separate bugs allowed silent tracking of whether an email had been opened.
Similar image-proxy bypasses were found in Gmail and ProtonMail, and one proof-of-concept even chained a Gmail vulnerability with AI browser prompt injection to exfiltrate Slack authentication tokens through an AI-powered email assistant.
Because these attacks rely purely on CSS and HTML, they can slip past antivirus tools, spam filters, and script-blocking defenses that focus on JavaScript-based threats. Several of the flaws have already been patched following bug bounty disclosures, including fixes from Fastmail, though some issues, such as the Outlook label-hijacking bug, reportedly remain unresolved.
Security experts recommend that webmail providers render untrusted email content inside sandboxed iframes, block automatic image loading, disallow risky CSS selectors like :has() and :checked, and restrict custom HTML attributes that could be abused as sanitizer-bypass gadgets.
For everyday users, avoiding auto-loaded remote images and treating unexpected login prompts inside emails with suspicion remains a practical first line of defense against this emerging threat.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
