A sophisticated new attack method called 'CSS bomb' is targeting webmail users by exploiting ordinary CSS styling code to hijack interfaces and spy on user activity. This technique manipulates trusted formatting features in major webmail platforms such as Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail. Researchers have discovered that these attacks can turn a routine HTML email into a stealth keylogger capable of capturing credentials as users type them, all without the need for JavaScript or traditional malware.
The researcher Gareth Heyes from PortSwigger investigated how webmail clients sanitize incoming HTML and CSS. These sanitizers are intended to strip out dangerous code while allowing emails to display correctly. However, discrepancies between what sanitizers deem safe and what browsers actually render can be exploited by attackers. By leveraging CSS mutation, attribute selectors, and pseudo-elements, attackers can manipulate select-menu dropdowns to mimic password fields. As victims type into these fake login boxes, each keystroke triggers a CSS rule that sends a background image request to a server controlled by the attacker, effectively logging the keystrokes.
This new research bypasses previous limitations by hijacking select elements and HTML labels to create a real-time password-stealing mechanism. Demonstrations showed successful exploits in Outlook and Fastmail, where attackers could spoof login screens and track email openings. Similar vulnerabilities were found in Gmail and ProtonMail, with some issues remaining unresolved despite several patches following bug bounty reports. Because these attacks rely on CSS and HTML, they can evade antivirus tools and script-blocking defenses focused on JavaScript threats.
Security experts advise webmail providers to render untrusted email content within sandboxed iframes, block automatic image loading, and restrict the use of risky CSS selectors. For users, avoiding auto-loaded remote images and being cautious about unexpected login prompts in emails are recommended defenses against these attacks.