CSS Bomb Attacks Steal Passwords via Malicious Emails

Key Takeaways

• A novel “CSS bomb” attack method exploits standard CSS styling within emails to steal credentials and track user activity in real-time.
• The attacks bypass traditional JavaScript defenses by weaponizing webmail client rendering discrepancies, affecting platforms like Outlook, Fastmail, Gmail, ProtonMail, Yahoo Mail, and AOL Mail.
• Attackers can spoof login screens and log keystrokes by manipulating HTML elements like select menus and labels, effectively creating a stealthy keylogger.
• While some vulnerabilities have been patched following disclosures, certain issues, such as an Outlook label-hijacking bug, reportedly remain unresolved.

A sophisticated new class of email-based attacks, dubbed “CSS bombs,” has emerged, capable of hijacking webmail interfaces, monitoring user actions, and even exfiltrating passwords in real-time. Crucially, these attacks achieve their malicious objectives without relying on JavaScript or traditional malware, making them particularly difficult to detect and defend against.

The “CSS bomb” technique weaponizes ubiquitous formatting features present in nearly all major webmail platforms. By transforming a seemingly innocuous HTML email into a covert keylogger, attackers can capture login credentials as victims type them into what appears to be a legitimate input field.

PortSwigger researcher Gareth Heyes conducted an in-depth analysis of how prominent webmail clients, including Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail, process and sanitize incoming HTML and CSS. These sanitization processes are designed to strip out dangerous code while preserving the intended display of fonts, colors, and layouts. Heyes’ research revealed that inconsistencies between what a sanitizer deems safe and what a web browser ultimately renders create critical vulnerabilities that attackers can exploit.

Understanding the CSS Bomb Attack

Attackers exploit various CSS quirks, such as CSS mutation, attribute selectors, and pseudo-elements like :before, :after, :has(), and :checked, to manipulate standard select-menu dropdowns. These manipulated elements are then made to visually mimic password input fields. When a user types into this deceptive field, each keystroke triggers a unique CSS rule. This rule silently initiates a background image request to a server controlled by the attacker, effectively logging every character typed by the victim.

Previous theoretical CSS keylogger concepts faced a significant hurdle: web browsers typically do not update HTML attributes when a user types into a standard input field, limiting their practical application.

Heyes’ groundbreaking research entirely circumvents this limitation. By instead hijacking <select> elements and HTML labels, the new method establishes a fully functional, real-time password-stealing mechanism. This technique remains effective even against emails protected by stringent sanitizers, including widely used solutions like DOMPurify.

Gareth Heyes successfully demonstrated working exploits against several platforms. In Outlook, a specific CSS “gadget” bug allowed attackers to break out of the email rendering window and display a highly convincing, spoofed Microsoft login screen. For Fastmail users, a technique dubbed “CSS hotwiring” enabled attackers to hijack any click on the page to trigger unintended actions, while separate vulnerabilities allowed for silent tracking of email open statuses.

Similar image-proxy bypasses were identified in Gmail and ProtonMail. One proof-of-concept even chained a Gmail vulnerability with AI browser prompt injection, facilitating the exfiltration of Slack authentication tokens via an AI-powered email assistant.

The pure CSS and HTML nature of these attacks allows them to evade detection by traditional security measures such as antivirus software, spam filters, and script-blocking defenses that primarily target JavaScript-based threats. Following responsible disclosure through bug bounty programs, several of these flaws have been patched, including fixes implemented by Fastmail. However, some vulnerabilities, such as the Outlook label-hijacking bug, are reportedly still unresolved.

What You Should Do

• For Webmail Providers: Implement robust sandboxing for untrusted email content using iframes. Configure email clients to block automatic loading of remote images by default. Disallow risky CSS selectors such as :has() and :checked. Restrict or carefully scrutinize custom HTML attributes that could be exploited as sanitizer-bypass gadgets.
• For Everyday Users: Disable automatic loading of remote images in your email client settings. Exercise extreme caution with any unexpected login prompts or forms appearing within emails, even if they appear to be from trusted sources. Always navigate directly to official websites for sensitive actions like logging in, rather than clicking links or interacting with forms embedded in emails.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.