# CSS Bomb Attacks: CSS-Based Trust-Boundary Bypass Leaks Webmail Passwords and Tokens (Outlook, Gmail, Yahoo, AOL, Fastmail, Proton Mail)

> PortSwigger researcher Gareth Heyes disclosed a class of "CSS bomb" attacks (Black Hat USA 2026) exploiting discrepancies between webmail HTML/CSS sanitizers and actual browser rendering to hijack trusted UI, capture passwords with no JavaScript, and exfiltrate authentication tokens across Outlook, Gmail, Fastmail, Yahoo Mail, AOL Mail, and Proton Mail.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1968
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-css-bomb-webmail-password-theft-tl-2026-1968.webp?v=2517f638 (Threadlinqs threat intel: CSS Bomb Webmail Attacks Steal Passwords: Detection & IOCs (TL-2026-1968) — High severity, 7 IOCs, 9 detection rules.)
- **ID:** TL-2026-1968
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7 (2 shown free below)

## Description

On 2026-08-06, PortSwigger researcher Gareth Heyes published "CSS: the bomb inside your inbox" and presented the work at Black Hat USA 2026, demonstrating that a malicious HTML email can abuse permitted-but-imperfectly-sanitized CSS to break the trust boundary between an email's rendered body and the surrounding webmail interface. Because these chains rely purely on CSS (and in some cases plain HTML) rather than JavaScript, they evade script-blocking sanitizers, antivirus scanning, and spam filters that are tuned to catch script-based payloads.

Across six major webmail providers the research demonstrates a spectrum of impact: silent open-tracking, click hijacking and page defacement, spoofed sign-in forms that capture a typed password without any script execution, real-time CSS-only keyloggers, and side-channel token exfiltration (via CSS attribute selectors, a font-height rendering oracle, and image-proxy bypasses) that can defeat Content-Security-Policy restrictions on outbound requests. An Outlook/Firefox chain spoofs a Microsoft sign-in screen using disguised <select> elements and a Firefox option-selection timer quirk to capture keystrokes in real time. A Yahoo/AOL paste-handling race condition exploits a Firefox timing gap between pasting rich content into a compose window and sanitization completing, letting an attacker recover enough of a 12-character Medium email-login token from a chain of CSS attribute-selector requests to reconstruct and reuse it. Fastmail was affected by two distinct CSS-mutation sanitizer bypasses (the browser's CSSOM decodes hex-escaped selector names post-sanitization, defeating prefix-based scoping) plus a backslash-escaped content:url() image-proxy bypass; all three were patched pre-publication for a $1,000 bounty each. Proton Mail had a nested-CSS-comment image-proxy bypass that stopped working during retesting before publication (silently fixed, no vendor acknowledgment). Gmail has an image-set() CSS custom-property fallback that still triggers a direct external request bypassing Gmail's image proxy as of publication; researchers state they gave up pushing Google for a fix. Outlook's label-hijacking trick (abusing <label for="id"> against unfiltered form-control IDs) and a chained sanitizer bypass (an invalid @media query plus a comment/quote-character confusion that smuggles arbitrary CSS, e.g. position:fixed overlays, past the sanitizer via allowlisted data-* attributes) both remained functional as of publication.

The research extends the trust-boundary bypass into AI-agent email integrations: a Gmail + Anthropic Claude Cowork chain combines indirect prompt injection with the Gmail image-set() bypass so the AI agent retrieves a Slack access token and places it into an HTML draft that leaks it when viewed; a separate proof-of-concept against OpenAI's Atlas AI browser hides malicious instructions inside a CSS :before pseudo-element's content property (via opacity/positioning tricks) so the LLM reads different instructions than the human sees, causing the agent to open an attacker-controlled tab carrying exfiltrated data in the URL hash. No CVE or CVSS score has been assigned — this is a technique-class disclosure spanning multiple independently-operated products rather than a single-vendor vulnerability.

## MITRE ATT&CK

- T1566 Phishing
- T1204.001 Malicious Link
- T1056.001 Keylogging
- T1056.002 GUI Input Capture
- T1528 Steal Application Access Token
- T1056.001 Keylogging
- T1027 Obfuscated Files or Information
- T1684.001 Impersonation
- T1071.001 Web Protocols
- AML.T0051 LLM Prompt Injection

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CSS Sanitizer-Bypass Signature in Inbound Webmail HTML (CSS Bomb Delivery)** (`TL-2026-1968-SPL-001`)

Detects inbound HTML email containing CSS sanitizer-bypass constructs used by the 'CSS bomb' webmail trust-boundary attack class (Outlook, Gmail, Fastmail, Proton Mail, Yahoo/AOL): hex-escaped CSSOM mutation defeating prefix-scoping, nested-CSS-comment and image-set(var()) image-proxy bypasses, escaped-backslash content:url() bypass, an invalid @media-query sanitizer-chain smuggling arbitrary CSS via comment/quote confusion, and allowlisted data-* attribute CSS gadgets (e.g. data-tabster) used to inject position:fixed overlays. No JavaScript is required, so this is invisible to script-blocking sanitizers and AV.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566, T1027, T1656
- **Data sources:** proofpoint_tap, microsoft_defender_o365_message_trace, mimecast_ttp, email_body_content_scan_custom_table
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=email sourcetype IN ("proofpoint:tap:message", "o365:management:activity", "mimecast:ttp", "exchange:message-body-scan")
| eval html_body=coalesce(message_body, body_html, MessageBody)
| where match(html_body, "content:url\(/\\5c") OR match(html_body, "/\*Url\(") OR match(html_body, "image-set\(var\(") OR match(html_body, "@media\s+--\w+;\s*/\*") OR match(html_body, "data-tabster") OR match(html_body, "[a-z]+\\7[0-9a-f]\\2[0-9a-f]")
| eval matched_signature=case(
    match(html_body, "content:url\(/\\5c"), "fastmail_image_proxy_backslash_bypass",
    match(html_body, "/\*Url\("), "proton_nested_comment_image_proxy_bypass",
    match(html_body, "image-set\(var\("), "gmail_imageset_var_fallback_bypass",
    match(html_body, "@media\s+--\w+;\s*/\*"), "outlook_media_query_sanitizer_chain",
    match(html_body, "data-tabster"), "outlook_data_attr_css_gadget",
    1=1, "hex_escaped_cssom_mutation")
| stats count min(_time) as first_seen max(_time) as last_seen values(subject) as subjects by sender, recipient, matched_signature
| where count > 0
| sort -count
```

### Microsoft KQL

```kql
let CSSBombSignatures = dynamic(["content:url(/\\5c", "/*Url(", "image-set(var(", "@media --", "data-tabster"]);
EmailBodyCSSScan_CL
| where TimeGenerated > ago(24h)
| where HtmlBody has_any (CSSBombSignatures) or HtmlBody matches regex @"[a-z]+\\7[0-9a-f]\\2[0-9a-f]"
| extend MatchedSignature = case(
    HtmlBody has "content:url(/\\5c", "fastmail_image_proxy_backslash_bypass",
    HtmlBody has "/*Url(", "proton_nested_comment_image_proxy_bypass",
    HtmlBody has "image-set(var(", "gmail_imageset_var_fallback_bypass",
    HtmlBody has "@media --", "outlook_media_query_sanitizer_chain",
    HtmlBody has "data-tabster", "outlook_data_attr_css_gadget",
    "hex_escaped_cssom_mutation")
| project TimeGenerated, SenderAddress, RecipientAddress, Subject, MatchedSignature
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Subjects = make_set(Subject) by SenderAddress, RecipientAddress, MatchedSignature
| where Count > 0
```

### Sigma

```yaml
title: Malicious CSS Sanitizer-Bypass Signature in Inbound Email (CSS Bomb Delivery)
id: 7e2a1c44-9b3d-4f2a-8e21-1a2b3c4d5e6f
status: experimental
description: Detects inbound HTML email containing CSS sanitizer-bypass constructs associated with the "CSS bomb" webmail trust-boundary attack class (Outlook, Gmail, Fastmail, Proton Mail, Yahoo/AOL) -- hex-escaped CSSOM mutation, nested-comment and image-set(var()) image-proxy bypasses, invalid @media sanitizer-chain smuggling, and data-* CSS gadget abuse.
references:
    - https://portswigger.net/research/css-the-bomb-inside-your-inbox
    - https://github.com/portswigger/css-the-bomb-inside-your-inbox
author: Threadlinqs Team
date: 2026-08-10
tags:
    - attack.initial-access
    - attack.t1566
    - attack.defense-evasion
    - attack.t1027
    - attack.t1656
    - attack.tool.shazzer
logsource:
    category: application
    product: email_gateway
detection:
    selection_signatures:
        HtmlBody|contains:
            - 'content:url(/\5c'
            - '/*Url('
            - 'image-set(var('
            - '@media --'
            - 'data-tabster'
    selection_hexmutation:
        HtmlBody|re: '[a-z]+\\7[0-9a-f]\\2[0-9a-f]'
    condition: selection_signatures or selection_hexmutation
falsepositives:
    - Legitimate marketing/newsletter HTML emails using unusual but benign CSS at-rules or vendor-specific data-* attributes
    - Security-awareness phishing-simulation emails intentionally replaying the public PoC payloads
level: high
```

**Known false positives:**

- Legitimate marketing/newsletter HTML emails that legitimately use unusual but benign CSS at-rules or vendor data-* attributes (e.g. UI-framework markup)
- Security-awareness phishing-simulation platforms intentionally replaying the public PortSwigger PoC payloads

**Tuning notes:** Tune the signature list per-organization webmail provider (drop Fastmail/Proton signatures once those vendor patches are confirmed applied org-wide); if the mail platform lacks a body-content-scan sink, stand up a transport-rule/Logic-App sidecar to populate EmailBodyCSSScan_CL before enabling the KQL variant.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CSS Sanitizer-Bypass Signature in Inbound Webmail HTML (CSS Bomb Delivery) (locked: unlock with TL Creds)
- Real-Time CSS Keylogger / UI-Redress Beacon Burst from Webmail Render Context (locked: unlock with TL Creds)
- CSS Side-Channel Token Exfiltration and AI-Agent Draft Token Leak (CSS Bomb C2/Exfil Stage) (locked: unlock with TL Creds)
- CSS Sanitizer-Bypass Signature in Inbound Webmail HTML (CSS Bomb Delivery) (locked: unlock with TL Creds)
- Real-Time CSS Keylogger / UI-Redress Beacon Burst from Webmail Render Context (locked: unlock with TL Creds)
- CSS Side-Channel Token Exfiltration and AI-Agent Draft Token Leak (CSS Bomb C2/Exfil Stage) (locked: unlock with TL Creds)
- Real-Time CSS Keylogger / UI-Redress Beacon Burst from Webmail Render Context (locked: unlock with TL Creds)
- CSS Side-Channel Token Exfiltration and AI-Agent Draft Token Leak (CSS Bomb C2/Exfil Stage) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 7)

Defanged, TLP:CLEAR.

- Domain: `02[.]rs`
- URL: `hxxps://github[.]com/portswigger/css-the-bomb-inside-your-inbox`

Full set of 7 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CSS: the bomb inside your inbox](https://portswigger.net/research/css-the-bomb-inside-your-inbox)
- [PoC repository: css-the-bomb-inside-your-inbox](https://github.com/portswigger/css-the-bomb-inside-your-inbox)
- [New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens](https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html)
- [New CSS Bomb Attacks Let Hackers Steal Passwords and Tokens](https://gbhackers.com/new-css-bomb-attacks-let-hackers-steal-passwords-and-tokens/)
- [CSS Bomb Attacks Turn Malicious Emails Into Password-Stealing Keyloggers](https://cybersecuritynews.com/css-bomb-attack/)
- [Webmail CSS Attacks Expose a New Risk for AI-Powered Email Tools](https://securityaffairs.com/196899/hacking/webmail-css-attacks-expose-a-new-risk-for-ai-powered-email-tools.html)
- [CSS: The Hidden Threat Lurking in Your Inbox](https://www.darkreading.com/cyberattacks-data-breaches/css-hidden-threat-lurking-inbox)
- [CSS Email Attacks Can Steal Webmail Passwords](https://blog.gridinsoft.com/css-email-attacks-webmail-password-theft/)
- [James Kettle (PortSwigger): CSS bomb research announcement](https://x.com/albinowax/status/2056801111399444742)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1968