CSS Bomb Attacks: CSS-Based Trust-Boundary Bypass Leaks Webmail Passwords and Tokens (Outlook, Gmail, Yahoo, AOL, Fastmail, Proton Mail)
CSS Bomb Attacks (TL-2026-1968), also tracked as CSS Bomb, is a high-severity software vulnerability, first published 2026-08-10. It has no confirmed attribution, affects Microsoft Outlook / Outlook.com Webmail, maps to 9 MITRE ATT&CK / ATLAS techniques (AML.T0051, T1027, T1056.001), and is covered by 9 detection rules and 7 indicators of compromise.
Key facts for TL-2026-1968
- Threat ID
- TL-2026-1968
- Also known as
- CSS Bomb, CSS: The Bomb Inside Your Inbox
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-10
- Last reviewed
- 2026-08-10
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in CSS Bomb Attacks
Malware and tooling: Hackvertor, Shazzer
PortSwigger researcher Gareth Heyes disclosed a class of "CSS bomb" attacks (Black Hat USA 2026) exploiting discrepancies between webmail HTML/CSS sanitizers and actual browser rendering to hijack trusted UI, capture passwords with no JavaScript, and exfiltrate authentication tokens across Outlook, Gmail, Fastmail, Yahoo Mail, AOL Mail, and Proton Mail.
How CSS Bomb Attacks works
On 2026-08-06, PortSwigger researcher Gareth Heyes published "CSS: the bomb inside your inbox" and presented the work at Black Hat USA 2026, demonstrating that a malicious HTML email can abuse permitted-but-imperfectly-sanitized CSS to break the trust boundary between an email's rendered body and the surrounding webmail interface. Because these chains rely purely on CSS (and in some cases plain HTML) rather than JavaScript, they evade script-blocking sanitizers, antivirus scanning, and spam filters that are tuned to catch script-based payloads.
Across six major webmail providers the research demonstrates a spectrum of impact: silent open-tracking, click hijacking and page defacement, spoofed sign-in forms that capture a typed password without any script execution, real-time CSS-only keyloggers, and side-channel token exfiltration (via CSS attribute selectors, a font-height rendering oracle, and image-proxy bypasses) that can defeat Content-Security-Policy restrictions on outbound requests. An Outlook/Firefox chain spoofs a Microsoft sign-in screen using disguised <select> elements and a Firefox option-selection timer quirk to capture keystrokes in real time. A Yahoo/AOL paste-handling race condition exploits a Firefox timing gap between pasting rich content into a compose window and sanitization completing, letting an attacker recover enough of a 12-character Medium email-login token from a chain of CSS attribute-selector requests to reconstruct and reuse it. Fastmail was affected by two distinct CSS-mutation sanitizer bypasses (the browser's CSSOM decodes hex-escaped selector names post-sanitization, defeating prefix-based scoping) plus a backslash-escaped content:url() image-proxy bypass; all three were patched pre-publication for a $1,000 bounty each. Proton Mail had a nested-CSS-comment image-proxy bypass that stopped working during retesting before publication (silently fixed, no vendor acknowledgment). Gmail has an image-set() CSS custom-property fallback that still triggers a direct external request bypassing Gmail's image proxy as of publication; researchers state they gave up pushing Google for a fix. Outlook's label-hijacking trick (abusing <label for="id"> against unfiltered form-control IDs) and a chained sanitizer bypass (an invalid @media query plus a comment/quote-character confusion that smuggles arbitrary CSS, e.g. position:fixed overlays, past the sanitizer via allowlisted data-* attributes) both remained functional as of publication.
The research extends the trust-boundary bypass into AI-agent email integrations: a Gmail + Anthropic Claude Cowork chain combines indirect prompt injection with the Gmail image-set() bypass so the AI agent retrieves a Slack access token and places it into an HTML draft that leaks it when viewed; a separate proof-of-concept against OpenAI's Atlas AI browser hides malicious instructions inside a CSS :before pseudo-element's content property (via opacity/positioning tricks) so the LLM reads different instructions than the human sees, causing the agent to open an attacker-controlled tab carrying exfiltrated data in the URL hash. No CVE or CVSS score has been assigned — this is a technique-class disclosure spanning multiple independently-operated products rather than a single-vendor vulnerability.
MITRE ATT&CK / ATLAS techniques used in TL-2026-1968
execution
AML.T0051 LLM Prompt Injection
Defense Evasion
T1027 Obfuscated Files or Information; T1684.001 Impersonation
Credential Access
T1056.001 Keylogging; T1056.002 GUI Input Capture; T1528 Steal Application Access Token
Collection
Command and Control
Execution
Initial Access
Affected products and versions in CSS Bomb Attacks
- Microsoft — Outlook / Outlook.com Webmail
Vulnerable versions: production web client as of 2026-08-06 - Google — Gmail
Vulnerable versions: production web client as of 2026-08-06 - Fastmail — Fastmail Webmail
Vulnerable versions: production web client prior to fix
Fixed in: production web client as of 2026-08-06 (two CSS-mutation bugs + image-proxy bypass patched) - Proton — Proton Mail
Vulnerable versions: production web client prior to fix
Fixed in: production web client as of 2026-08-06 (nested-comment image-proxy bypass silently fixed) - Yahoo — Yahoo Mail
Vulnerable versions: production web client (Firefox) as of 2026-08-06 - AOL — AOL Mail
Vulnerable versions: production web client (Firefox) as of 2026-08-06 - Anthropic — Claude Cowork (Gmail connector)
Vulnerable versions: Gmail-integrated agent as of 2026-08-06 - OpenAI — Atlas AI browser
Vulnerable versions: as of 2026-08-06; product reported scheduled for discontinuation 2026-08-09
Remediation for CSS Bomb Attacks
Patches
- Fastmail: patched two CSS-mutation (CSSOM hex-escape decoding) sanitizer bypasses and a backslash-escaped content:url() image-proxy bypass ahead of publication; $1,000 bug bounty paid for each
- Proton Mail: nested-CSS-comment image-proxy bypass (background:/*Url( Url(//x)*/url(//x);) no longer functional as of retesting before publication
Immediate actions
- Render HTML email inside a strictly sandboxed iframe with a locked-down CSP that blocks external image, font, and background-image requests originating from message content
- Strip or disable interaction-driven CSS selectors and pseudo-classes in the email sanitizer (:has, :checked, :focus, :not) that enable click-hijacking and keylogging chains
- Strip <label for>, <select>/<option>, and other form-control-capable elements from sanitized email HTML so they cannot be wired to surrounding UI controls
- Fully normalize and re-validate any remote CSS/image URL against the actual resolved target (reject escaped, hex-encoded, or nested-comment variants) rather than pattern-matching the raw source string before an image proxy fetches it
Workarounds
- Users: avoid pasting untrusted rich-text/HTML content into webmail compose or draft windows, which mitigates the Yahoo/AOL paste-race token-theft chain
- Users/orgs: enforce phishing-resistant MFA so a password captured via a spoofed sign-in form alone cannot complete authentication
- Orgs: disable or tightly scope AI email-agent connectors (e.g. Gmail-integrated LLM tools) until the vendor confirms prompt-injection-resistant handling of hidden/off-screen CSS content
Longer-term hardening
- Revalidate sanitizer output against the browser's actual parsed CSSOM, not the pre-sanitization string, to catch CSS-mutation bypasses where the browser decodes hex escapes after the sanitizer has already approved the text
- Restrict AI email/agent integrations (e.g. Gmail-connected LLM agents such as Claude Cowork) from acting on hidden, zero-opacity, or off-screen DOM/CSS content, and require explicit human confirmation before an agent surfaces a retrieved credential or token in a draft or output
- Move from block-list to strict allow-list CSS parsing that rejects any property, selector, or at-rule not on an explicit safe list, instead of trying to enumerate dangerous constructs
- Commission recurring third-party CSS-quirk fuzzing (Shazzer-style) of webmail HTML/CSS sanitizers to catch parser/sanitizer divergence before disclosure
Weaknesses (CWE) in CSS Bomb Attacks
CWE-79, CWE-116, CWE-451, CWE-1021
Timeline of CSS Bomb Attacks
- Researchers demonstrate an indirect prompt-injection PoC against OpenAI's Atlas AI browser, hiding instructions in a CSS :before pseudo-element's content so the AI reads different text than the human sees, causing it to open an attacker-controlled tab carrying exfiltrated data in the URL hash.
- Researchers demonstrate a Gmail + Anthropic Claude Cowork chain: prompt injection combined with the image-set() bypass causes the AI agent to retrieve and leak a Slack access token via an HTML draft.
- Gmail's image-set() CSS variable-fallback image-proxy bypass remains functional as of publication; researchers state they gave up pushing Google for a fix.
- Outlook's label-jacking UI-hijack trick and chained CSS-gadget sanitizer bypass remain functional as of publication; Microsoft has not fixed the issue.
- Proton Mail's nested-CSS-comment image-proxy bypass silently stops working during retesting before publication, with no vendor acknowledgment.
- Fastmail patches two CSS-mutation bugs and an image-proxy escaped-backslash bypass ahead of publication, paying a $1,000 bug bounty for each.
- PortSwigger publishes a public PoC repository (github.com/portswigger/css-the-bomb-inside-your-inbox) with 10 attack demonstrations plus supporting tools (Shazzer, Hackvertor, a CSS token-exfiltration utility).
- PortSwigger researcher Gareth Heyes publishes "CSS: the bomb inside your inbox" and presents the research at Black Hat USA 2026, disclosing CSS-based trust-boundary attacks across six major webmail providers.
- GBHackers publishes coverage of the CSS bomb attack research, the article that triggered this threat intel entry.
Sources cited for CSS Bomb Attacks
- CSS: the bomb inside your inbox
- PoC repository: css-the-bomb-inside-your-inbox
- New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens
- New CSS Bomb Attacks Let Hackers Steal Passwords and Tokens
- CSS Bomb Attacks Turn Malicious Emails Into Password-Stealing Keyloggers
- Webmail CSS Attacks Expose a New Risk for AI-Powered Email Tools
- CSS: The Hidden Threat Lurking in Your Inbox
- CSS Email Attacks Can Steal Webmail Passwords
- James Kettle (PortSwigger): CSS bomb research announcement
Threats related to CSS Bomb Attacks
- CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail
- Critical Type Confusion in isolated-vm (GHSA-864f-rcv7-6rh4) Enables Sandbox Escape and RCE on Host
- Critical Microsoft Copilot CoSnitch Vulnerability (CVE-2026-24301) Enabled One-Click Data Theft From Connected Accounts
- Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework Flaws (CVE-2026-59822, CVE-2026-42271, CVE-2026-48710) for RCE and Cryptomining
Detection coverage for TL-2026-1968
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1968 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.