Hidden Threat Lurks in Your Inbox: CSS-Based Attacks on the Rise
Cybersecurity researchers have sounded the alarm about a new threat lurking in plain sight: Cascading Style Sheets (CSS) attacks that can exfiltrate data from webmail platforms. These attacks are made possible by the powerful capabilities of CSS, which is often overlooked and underestimated. But with the rise of these threats, it’s time to take notice.
Gareth Heyes, a web security researcher at PortSwigger, has been investigating CSS-based attacks for some time now. He discovered that malicious CSS code can be used to steal sensitive information from users, including login credentials and credit card numbers. What’s more, this can be done without the need for JavaScript or attachments – just plain old HTML and CSS.
The reason why these threats have gone undetected is because of their complexity. “You’ve got to work a bit harder” to exploit them, says Heyes. But that doesn’t mean they’re not worth worrying about. In fact, Heyes believes that CSS-based attacks will become the next big frontier in cybersecurity, with more and more companies becoming vulnerable.
The problem is that as browsers continue to add new features to HTML and CSS, the attack surface grows exponentially. This means that hackers are constantly finding new ways to exploit these vulnerabilities. And it’s not just a matter of users being aware – webmail vendors have a responsibility to protect their customers from these threats.
Heyes’ research has revealed significant flaws in some major email platforms, including big-name companies that many people use every day. But despite the severity of these findings, some vendors have been slow to respond or even dismissed them altogether. This is a worrying trend, especially given the potential consequences of these attacks.
So what can users do to protect themselves? The answer is not much – unless they have knowledge of HTML and CSS, that is. Webmail vendors, on the other hand, need to take steps to filter and sanitize user displays, and implement image proxies to prevent hijacking bugs.
The reality is that CSS-based attacks are already here, and it’s only a matter of time before we see more widespread exploitation. As Heyes puts it, “CSS and its attack surface isn’t waiting for anyone.” It’s up to webmail vendors to take this threat seriously and prioritize security over aesthetics.
Ultimately, the takeaway from this story is that cybersecurity threats are constantly evolving, and companies need to stay ahead of the curve. By acknowledging the potential risks of CSS-based attacks, we can begin to mitigate them before they become a major problem. As users, it’s time to be aware of this new threat – and to demand more from our webmail vendors in terms of security.
Source: Dark Reading — 2026-08-05