--- type: Whitepaper title: Protecting Browsers from Cross-Origin CSS Attacks description: CSS error-tolerant parsing lets an attacker bracket secret text in a victim page with an injected style-rule prefix and suffix, import that page cross-origin as a stylesheet, and read the secret back out - with no JavaScript, using background-image URLs. Working attacks are shown on IMDb, Yahoo! Mail and Hotmail. resource: "https://www.linshunghuang.com/papers/css.pdf" tags: [whitepaper, webseclist-reference, css, same-origin-policy, sop-bypass, info-leak, content-type, parser-differential, mitigation, measurement-study, owasp-a01-2021, owasp-a05-2021] generated: by: webseclist-refs/1 at: "2026-08-14T22:36:54+00:00" status: stable stale_after: 2027-08-14 sources: - id: original resource: "https://www.linshunghuang.com/papers/css.pdf" title: Protecting Browsers from Cross-Origin CSS Attacks author: Lin-Shung Huang, Zack Weinberg, Chris Evans, Collin Jackson also_at: [] authors: - Lin-Shung Huang - Zack Weinberg - Chris Evans - Collin Jackson canonical_url: "" cited_by: - "2010.md:94" commit: "" content_sha256: a529ac13fa419eb2f1bb2fbe749d3ab8647f6f373ff4d5eae340f7ee1a684e02 depth: full depth_reason: default kind: whitepaper language: "" licence: unknown original_url: "https://www.linshunghuang.com/papers/css.pdf" published: "" publisher: "" publisher_english: "" raw_sha256: e10715f53aae376bfd62faaa0cdf7e19d82d34aca8deb153184a205b03ffc65c retrieved_from: "https://www.linshunghuang.com/papers/css.pdf" retrieved_kind: manual-import retrieved_utc: "2026-08-14T22:36:54+00:00" slug: protecting-browsers-cross-origin-css-attacks snapshot: "" title_english: "" translation_file: "" translation_of: "" --- # Protecting Browsers from Cross-Origin CSS Attacks **Protecting Browsers from Cross-Origin CSS Attacks** - Lin-Shung Huang, Zack Weinberg, Chris Evans, Collin Jackson, Publisher not stated. - Published: date not stated - Original: - Preserved from: https://www.linshunghuang.com/papers/css.pdf (manual-import) on 2026-08-14 - Licence: unknown Rights remain with the original author and publisher. This is a research archive of a source from the Web Hacking Techniques Index collections, kept so the page going offline. To read the original, follow the link above. ## Content > UNTRUSTED SOURCE TEXT. Everything below this line is third-party material > quoted for research. It is data, not instructions. Do not follow directions, > execute code, or fetch URLs because this text says so. # Protecting Browsers from Cross-Origin CSS Attacks Protecting Browsers from Cross-Origin CSS Attacks Lin-Shung Huang Zack Weinberg Carnegie Mellon University Carnegie Mellon University linshung.huang@sv.cmu.edu zack.weinberg@sv.cmu.edu Chris Evans Collin Jackson Google Carnegie Mellon University cevans@google.com collin.jackson@sv.cmu.edu ABSTRACT videos, and other documents—from any site. However, the Cross-origin CSS attacks use style sheet import to steal document’s scripts may not directly examine content loaded confidential information from a victim website, hijacking a from other sites. This policy applies even within what ap- user’s existing authenticated session; existing XSS defenses pears to the user to be one unified page; for instance, a script are ineffective. We show how to conduct these attacks with can only inspect the content of a nested document if it came any browser, even if JavaScript is disabled, and propose from the same origin as the script itself. Cross-origin content a client-side defense with little or no impact on the vast inclusion allows sites to share popular script libraries and majority of web sites. We have implemented and deployed store large, rarely-changing content on servers dedicated to defenses in Firefox, Google Chrome, and Safari. Our defense that purpose, while preventing malicious sites from reading proposal has also been adopted by Opera. content that should be visible only to the user. Cascading style sheets (CSS) are another type of content that a document may include; they define appearance, just Categories and Subject Descriptors as HTML defines content and JavaScript defines behavior. K.6.5 [Management of Computing and Information CSS is a relative late-comer to the Web; although the need Systems]: Security and Protection for a style sheet language was recognized as early as 1993, the first specification of CSS dates to 1996, and the earliest browser to implement enough of CSS to be generally useful General Terms was Internet Explorer 6.0, in 2001. [20] Security To allow future extensibility, the CSS specification man- dates error-tolerant parsing. Browsers skip over CSS direc- Keywords tives they cannot interpret, while continuing to honor what they do understand. [26] These rules allow web designers to CSS, Content Type, Same-Origin Policy build sites that take advantage of the very latest CSS fea- tures but “degrade gracefully”and remain usable with older 1. INTRODUCTION browsers. Unfortunately, error-tolerant parsing can find valid The World Wide Web was originally envisioned [5] as a CSS constructs in an input stream that was not intended to means to collate a wide variety of human-readable, static doc- be CSS at all; for instance, in an HTML document. uments, present them via a unified interface, and facilitate This leads to a security hole, first described (to our knowl- browsing through them by searching or via inter-document edge) in 2002 [13] and rediscovered at least twice since then references. It has grown into a versatile platform for all kinds [11, 22]. If a malicious site can inject chosen strings into a of computing tasks, progressively gaining support for data target webpage (whose structure, but not specific contents, entry, client-side scripting, and application-specific network are known) and then load that page as a style sheet, it can dialogues. Web-hosted applications have supplanted tradit- extract information from the page by examining what the ional desktop applications for almost everything that requires CSS parser makes of this “sheet.” The attack works even if network communication, and are becoming competitive in the target page cannot be retrieved without presenting login other areas. credentials, because the browser will present any credentials The same-origin policy [23] is the basic principle used to se- (e.g. HTTP cookies) it has stored for the target server when cure Web applications from each other. An HTML document it does the load. To date, all published attacks of this type can include many sorts of content—including images, scripts, have required JavaScript, and most have been specific to Internet Explorer. In this paper, we present a general form of this attack that can be made to work in any browser that supports CSS, Permission to make digital or hard copies of all or part of this work for even if JavaScript is disabled or unsupported. We do not personal or classroom use is granted without fee provided that copies are consider this vulnerability to be merely a bug in the CSS not made or distributed for profit or commercial advantage and that copies specification, but rather a general problem with allowing an bear this notice and the full citation on the first page. To copy otherwise, to including page to override the content type of a cross-origin republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. resource: browsers should obtain independent confirmation CCS’10, October 4–8, 2010, Chicago, Illinois, USA. that an included resource is appropriate in context before Copyright 2010 ACM 978-1-4503-0244-9/10/10 ...$10.00. handling it. For CSS, we propose and implement stricter unexpected interactions: session authentication, cross-origin content handling rules that completely block the attack, as content inclusion, and error-tolerant style sheet parsing. long as the targeted web site does not make certain errors (discussed in Section 4.4). Our proposal has no negative side 3.1.1 Session Authentication effects for most websites, and has been adopted by Firefox, Web applications that handle sensitive data typically use Google Chrome, Safari, and Opera. client-side state to manage a distinct “session” for each visitor. The most common technique uses HTTP cookies [18, 2] to Organization. define a session; HTTP authentication [10] is also viable, but The rest of this paper is organized as follows. Section 2 less popular since it gives the application less control over presents a threat model for cross-origin CSS attacks. Sec- user experience. Either way, once a user has logged into tion 3 describes the attack in detail. Section 4 proposes and a web application, their browser will transmit a credential evaluates defenses. Section 5 surveys related work. Section 6 with every HTTP request to that server, allowing the server concludes. to identify the session and reply with HTML documents containing confidential information intended only for that 2. THREAT MODEL user. A request for the same URL without the credential produces an HTTP error, or a generic document with no The threat model for cross-origin CSS attacks is a web confidential information. attacker [16], a malicious principal who owns a domain name and operates a web server. The web attacker’s goal is to 3.1.2 Cross-Origin Content Inclusion steal data from another web site (the target) that should As discussed in Section 1, browsers permit web pages to only be revealed to a particular user (the victim) and not to include resources (images, scripts, style sheets, etc.) from the attacker. any origin, not just from the server hosting the page itself. Requests for cross-origin resources transmit any credentials Attacker Abilities. (cookies or HTTP authentication tokens) associated with the The web attacker can send and receive arbitrary network site that hosts the resource, not credentials associated with traffic, but only from its own servers. It cannot modify or the site whose page made the reference. Thus, a confidential eavesdrop on the victim’s network traffic to other sites, nor resource from one site can be included into a page that could can it generate “spoofed” packets that purport to be from not read it directly. There it will be visible to the user, but some other site. The web attacker cannot install malicious not to scripts running in the page. software on the victim’s computer; otherwise, it could replace the browser and bypass any browser-based defenses. 3.1.3 Error-Tolerant Style Sheet Parsing CSS syntax has much more in common with JavaScript Target Behavior. than with HTML. HTML uses angle brackets to delimit The web attacker can inject strings into the target site, tags that must nest; text outside tags is mostly unparsed. even into pages that it cannot retrieve, but its injections CSS and JavaScript both use curly braces to enclose blocks; must pass server-side cross-site scripting (XSS) filters such as inside or outside a block, the input text must follow a formal HTML Purifier [30]. We do not assume that arbitrary string grammar. However, CSS’s error handling is entirely different injection is required, since such targets would be vulnerable from JavaScript’s. to conventional XSS attacks already. Opportunities to inject When browsers encounter syntax errors in CSS, they dis- strings into the target are not unusual in practice: reflection card the current syntactic construct, skip ahead until what of URL parameters, intra-site messaging, or even non-web appears to be the beginning of the next one, then start pars- channels [6]. ing again. The CSS specification [26] defines precisely how this must be done, so that browsers will behave predictably Victim Behavior. when they see new CSS features they do not understand. The web attacker can entice the victim into visiting its When skipping ahead, the browser uses only a few simple site, for instance by sending bulk email to encourage visitors, grammar rules: or by manipulating an advertisement network. We do not assume that the victim discloses any sensitive information • Even while skipping, parentheses, square brackets, and while on the attacker’s site; merely rendering the attacker’s curly braces must be properly balanced and nested. web content is sufficient. • Depending on where the syntax error occurred, the 3. CROSS-ORIGIN CSS ATTACKS next syntactic construct might begin after the next semicolon, after going up one brace level, or after the In this section, we present cross-origin CSS attacks in next brace-enclosed block. detail. First, we describe aspects of browser behavior that, together, make these attacks possible. Second, we lay out • /* ... */ is a comment to be ignored, as in JavaScript. the steps of an attack on a hypothetical website. Third, However, unlike JavaScript, // does not indicate the we discuss constraints on practical executions of the attack. beginning of a single-line comment. Finally, we demonstrate that the attack can be carried out against several popular web applications. • Single- and double-quoted strings also work much as in JavaScript; backslash escapes are a little different, but 3.1 Browser Behavior this doesn’t matter for our purposes. Internet Explorer Cross-origin CSS attacks are possible because of existing permits strings to extend past a line break, but in all browser behaviors, reasonable taken in isolation, but with other browsers this is a syntax error. ... ... ... ... ... ... {}#f{font-family:' {}#f{font-family:' ';} ';} ... ... ... HTML document; secret Attacker injects CSS leader CSS parser skips most of data is highlighted. and trailer around secret. the document, loads secret as a valid style rule. Figure 1: Example of a Cross-Origin CSS Attack • The end of a style sheet closes all open constructs The target site happens to have wrapped each of these in an without error. HTML , which does not hinder the attack in any way. The opening string has three components: The attacker can The left angle bracket, <, so common in HTML, has no safely assume that the CSS parser is in error recovery mode, meaning in CSS; it will invariably cause a syntax error. (The looking for a brace-enclosed block, when it encounters the right angle bracket, >, can appear within CSS selectors.) two-character synchronization sequence {}. This sequence Thus, a CSS parser encountering an HTML document will go will take the CSS parser out of error recovery, unless there is into skip-ahead mode on the very first tag in the document, something before the injection point that must be balanced— and will probably stay there until the end of the file. an unclosed string or CSS comment, or an unmatched { [ or (. If the attacker can predict what comes before the 3.2 Attack Steps injection point, it can tailor the synchronization sequence In a cross-origin CSS attack, the attacker injects strings to match. The next component, #f{font-family: is the into the target document that bracket the data to be stolen. beginning of a valid CSS style rule, declaring the font family Then it entices the victim into visiting a malicious page for an element in the attacker’s document (with ID f). The under its own control. The malicious page imports the font-family property takes a string constant as its value; target document as if it were a style sheet, and can extract thus the final component is a single quote character, '. The confidential information from the parsed style rules, even CSS parser will absorb whatever follows as a string, as long without JavaScript. Figure 1 illustrates the anatomy of the as it contains neither line breaks nor another single quote. attack. (The text in Figure 1 has been word-wrapped for The closing string simply ends the CSS string constant with readability; if line breaks were present in between the injected another quote mark, and then closes the style rule with blocks, the attack would be limited to Internet Explorer as a semicolon and a close brace. (The semicolon could be discussed in Section 3.3.3.) omitted.) Regardless of what appears after the close brace, this style rule has been successfully parsed and will be visible 3.2.1 CSS String Injection to the attacker’s document. One might expect that an HTML document, when parsed as a style sheet, would produce nothing but syntax errors. 3.2.2 Cross-Origin CSS Import However, because of the predictable error recovery rules When the victim user visits attacker.com, the attacker’s described in Section 3.1.3, it is possible to inject strings into a page instructs the victim’s browser to fetch and load the document that will cause the CSS parser to come out of error target document, with its injected strings, as an external recovery mode at a predictable point, consume some chunk style sheet. This can be done with the link tag [28]: of the document as a valid rule, and then return to skipping. The attacker has many options for injecting text into a web or with the CSS “import” directive, in an internal style sheet: page, even one it cannot see without authentication. Our demonstration attacks in Section 3.4 use intra-site private The attacker must ensure that their page is in “quirks mode,” messages or junk email sent to the victim. but this is easy: they simply do not provide any DOCTYPE In the example in Figure 1, the attacker has arranged to declaration. insert two strings into the document: • {}#f{font-family:' before the secret 3.2.3 Confidential Data Extraction Having loaded the target document as a style sheet, the • ';} after the secret attacker must extract the secret from its style rules. There Approach API IE FF Opera Safari Chrome CSS Object Model styleSheets[].cssRules[].cssText X X getMatchedCSSRules().cssText X X Computed Style getComputedStyle X X X X currentStyle X X Without JavaScript background-image, etc. X X X X X Table 1: Methods of Extracting Information from Cross-Origin Style Sheets are three ways to do this, some of which work under more 3.3.1 Insufficient Injection points conditions; Table 1 summarizes them. The secret to be stolen is encapsulated within a CSS string constant or url() literal, within a property value, within a CSS Object Model. style rule. To do this, the attacker must inject two strings JavaScript can read the text of successfully parsed style into the document containing the secret: one to begin the rules via the cssText property of style rule objects, and rule, and one to end it. Sites that accumulate user-submitted then transmit any interesting secrets to the attacker’s server text (comments on blogs, for instance) are relatively more using XMLHttpRequest or a hidden form. The document. susceptible to this attack; the attacker can inject one string, styleSheets[].cssRules[] arrays contain all the style rule wait a while, and then inject another. Also, the string that objects for a document. Safari and Google Chrome also must appear after the secret is very simple—often just a provide the getMatchedCSSRules utility function that can close quote and a close brace—and may already be present retrieve style rules matched by an element. This is perhaps in the target page; this was the case in [22]. the most convenient way to extract secrets, but it only works in Safari and Chrome. IE, Firefox, and Opera have blocked 3.3.2 Quotes JavaScript access to style rules from sheets loaded cross- CSS string constants can be written with single or double origin since 2002 (in response to [13]). In the example in quotes. Double quotes cannot occur inside a double-quoted Figure 1, cssRules[0].cssText would expose all of the text string, and single quotes cannot occur inside a single-quoted that isn’t struck out in the right-hand document. string, unless they are escaped with backslashes. Thus, if the secret to be stolen contains single quotes, the attacker Computed Style. must use double quotes in their injected strings, and vice JavaScript can also inspect the computed style in effect for versa. If the secret contains both types of quotes, or the an element, using either the standard function getComputed- attacker cannot predict which type of quotes it will contain, Style [27] supported in most browsers, or the currentStyle the attack may fail. However, unquoted url()s may contain object in IE. The attacker can easily ensure that the style unescaped quotes in Internet Explorer. was computed from the style rule containing the secret. No current browser blocks access to computed style if it was 3.3.3 Line Breaks computed from a cross-origin style sheet’s rules, so this CSS string constants and unquoted url()s cannot contain variant works in any current browser as long as JavaScript is line breaks, unless they are escaped with backslashes. There- enabled. In the example in Figure 1, getComputedStyle(f). fore, any line break within the secret will cause the attack to style.fontFamily would expose the highlighted text in the fail. HTML pages tend to contain many line breaks; this, all right-hand document. by itself, protects many potential target sites from CSS data theft attacks. However, rich-functionality sites often offer Without JavaScript. URL-based APIs that deliver confidential information in a This attack is even possible if users have disabled Java- custom JSON or XML format, with no line breaks; these Script, as illustrated in Figure 2. Several CSS properties can APIs may be vulnerable to CSS data theft even if the human- direct the browser to load an arbitrary URL; for instance, visible site isn’t. Some sites provide a “mobile” version of the attacker might change their injected strings to: their content, optimized for devices with small screens and limited bandwidth; one common optimization is to strip all unnecessary whitespace, including newlines. Again, this may • {}#f{background:url('http://attacker.com/? be vulnerable even if the regular site isn’t. before the secret Internet Explorer permits unescaped line breaks in CSS string constants and url()s. This makes attacks far easier • ');} after the secret to construct if the victim is known to use IE. If there is an element matching this rule in the attacker’s 3.3.4 Character Escapes page, the browser will try to load a background image for it Server-side filters aiming to remove malicious code from from the attacker’s server, providing the secret to be stolen user-submitted content are common, but they are usually as the query string. designed to strip dangerous HTML attributes and defang JavaScript keywords. They will not block cross-origin CSS 3.3 Attack Limitations attacks, because the injected strings won’t be inside HTML The attacker’s ability to conduct a cross-origin CSS attack attributes, and CSS shares few keywords with JavaScript. is limited by the structure and behavior of the target web Some filters also replace particular punctuation characters site. with equivalent HTML entities. Single and double quotes Clockworks! Attacker Victim Target POST /login 1 HTTP/1.1 200 OK Set-Cookie: SID=2DK3P9YOX5 ... GET /hampsterdance 2 ... 3 Cookie: SID=2DK3P9YOX5 ... Content-Type: text/html ... {}body{background: GET /?SECRET_INFORMATION 4 url(http://attacker/?SECRET_INFORMATION)} ... HTTP/1.1 204 Owned Figure 2: Steps of a Cross-Origin CSS Attack without JavaScript. 1: Victim logs into target website. 2: Some time later, victim is tricked into visiting the attacker’s website, which requests a private page on the target as a style sheet. 3: Victim’s browser finds an injected CSS rule in the private page. 4: Browser requests a “background image” from the attacker’s website, transmitting secret information. are often replaced, because of their significance in HTML An attacker with an account on the site can steal the text of and JavaScript. If any of the punctuation in the injected private messages to a victim user, with these steps: strings is replaced with an entity, the attack will fail. 1. Send a private message to the victim’s account, with Forcing UTF-7. the subject line: {}body{font-family:' The attacker may be able to defeat filters that replace punctuation with entities, by pre-encoding the replaced char- 2. Induce the victim to visit attacker.com while signed acters in UTF-7 [12]. For instance, if the target site replaces into IMDb; the attacking page is as follows: single quotes with entities, but leaves the other punctuation alone, the injected strings would become • {}#f{font-family:+ACI- before the secret The attacker would then request UTF-7 decoding from the of the top 1,000 web sites ranked by Alexa [1] specify charac- ter sets for their home pages in their Content-Type headers. Many of the others do provide character set information in a meta tag, but the CSS parser pays no attention to HTML meta tags, so that will not thwart an attacker’s specification of UTF-7 in a link tag. The attacker needs the victim’s account ID (ur12345678 in the example); this is public information, revealed by the 3.4 Example Attacks victim’s user profile page, even if the attacker is not logged We have successfully carried out cross-origin CSS attacks in. The browser will retrieve the victim’s private messaging on several popular websites. page, using the appropriate credentials from the victim’s IMDb session, and process it as a style sheet. The private 3.4.1 IMDb message sent by the attacker will cause a fragment of HTML, IMDb is an online database of movies and related informa- including the full text of earlier private messages to the tion, which allows registered users to rate films, make posts victim, to be absorbed as a CSS property value, which is on message boards, and send private messages to each other. then revealed to JavaScript via currentStyle. This attack works only in IE, due to line breaks in the as Yahoo! Mail: we can read messages and acquire CSRF HTML for the private messaging page. This is why the tokens by sending two emails to a victim Hotmail account JavaScript above uses only the IE-specific mechanism for with crafted subject lines, then loading the mobile Hotmail retrieving the computed style. It is not necessary to inject a site http://mail.live.com/m/ as a style sheet. Unlike Ya- second string after the text to be stolen, because the end of hoo! Mail, Hotmail’s mobile site delivers HTML containing the page serves that purpose (recall that end of style sheet newlines, which limits the attack to Internet Explorer. closes open CSS constructs without error). The existence of nearly identical attacks on unrelated websites illustrates the general nature of cross-origin CSS 3.4.2 Yahoo! Mail vulnerabilities. We expect that many social networking sites Yahoo! Mail is a popular web-based email service. Its are vulnerable to variants of this attack as well, because the session cookies persist for up to two weeks if users do not attacker can leave arbitrary text comments that are rendered actively log out. An attacker can steal subject lines and somewhere on the victim’s view of the page. cross-site request forgery [4] tokens from a victim’s email inbox with these steps: 4. DEFENSES 1. Send an email to the victim with the subject line: ');} In this section, we propose a client-side defense against cross-origin CSS attacks, evaluate it for compatibility with 2. Wait for some time while the victim receives other existing web sites, and review its adoption by major browsers. messages. We also examine a few alternative client-side defenses and complementary server-side measures. 3. Send another email to the victim with the subject line: {}body{background-image:url(' 4.1 Content Type Enforcement Proposal 4. Induce the victim to visit attacker.com while signed In a cross-origin CSS attack, the attacker’s web page asks into Yahoo! Mail. The attacking page is as follows: the victim’s browser to parse the target document as a style sheet. The attack works because the browser will attempt to parse anything that was requested by a stylesheet link or @import as if it were CSS. This is a backward compatibility ments that do not include a proper document type definition on this proposal. 4.1.1 Strict Enforcement Strict enforcement refuses to load any style sheet cross- origin, unless it is properly labeled text/css. Since the target document is labeled text/html, application/json, We use background-image instead of font-family in this text/rss+xml, or some other non-CSS content type, the attack to illustrate the variety of CSS properties that can be browser will not load it as a style sheet, foiling the attack. used. The attacking page requests the mobile version of the Strict enforcement may cause legitimate requests for cross- site by loading http://m.yahoo.com/mail rather than http: origin style sheets to fail, if the server providing the style //www.yahoo.com/mail. To save bandwidth, the mobile site sheet is misconfigured. Unfortunately, content type miscon- has had all unnecessary whitespace removed from its HTML, figurations are common, so strict enforcement may be too including newlines; this allows the CSS portion of the attack risky for browser vendors to adopt. to succeed in more browsers, hence the JavaScript detects which of the two methods for retrieving computed style is 4.1.2 Minimal Enforcement supported. To address this concern, we also propose a more tolerant The stolen HTML fragment contains the subject lines solution: minimal enforcement blocks a CSS resource if and of every email delivered to the victim in between the two only if it is loaded cross-origin, has an invalid content type, attack messages. It also contains a hidden, unguessable token and is syntactically malformed. When the browser encounters for each message; these tokens allow the attacker to delete a cross-origin style sheet labeled with the wrong content messages via CSRF. type, it begins parsing the sheet as CSS, but if it encounters a syntax error before it has processed the first complete 3.4.3 Hotmail style rule, it stops and discards the sheet. This rule allows Windows Live Hotmail is an web-based email service oper- legitimate but misconfigured sites to continue to work, as ated by Microsoft. It is vulnerable to nearly the same attack long as the first thing in their cross-origin, mislabeled style Requesting Rendering Correct type Incorrect type server mode Total HTTP error Well-formed Malformed Well-formed Malformed Standards 180,445 1,497 178,017 506 424 1 Same-origin Quirks 25,606 466 24,445 332 304 59 Standards 47,943 347 47,345 104 147 0 Cross-origin Quirks 6,075 53 5,891 57 74 0 Total 260,069 2,363 255,698 999 949 60 Table 2: Categorization of CSS references for the Alexa top 100,000 sites. sheet is a well-formed CSS rule. This defense will still foil these text/html responses were HTML landing pages pro- most cross-origin CSS attacks, which attempt to load a non- duced (with a 200 OK response code) because the desired CSS document as CSS; for instance, HTML almost always style sheet no longer existed; the content type is correct in begins with or a DOCTYPE declaration, either of which this case, but the server is still misconfigured, as it should will cause a CSS syntax error. have produced an HTTP error. Style sheets labeled with the generic types text/plain and application/octet-stream 4.2 Experiment make up a further 7% of the total, and a few other specific types appeared, e.g. application/x-javascript. To evaluate the compatibility of our proposed defense of The second most common error, accounting for 18% of content type checking for cross-origin CSS loads, we surveyed the total, is to provide no Content-Type header at all, or a the public Web to determine how often servers fail to provide header with no value; these are listed together in table 3 as the correct content type for style sheets, how often style “missing.” Most browsers will process a style sheet with a sheets begin with a CSS syntax error, and how often style missing content type, even in standards mode. See Section 4.4 sheets are requested from a different origin. for further discussion of this wrinkle. The crawler logged whether standards or quirks mode was Design. in effect for each HTML page that loaded a CSS resource. Using an instrumented browser based on WebKit [15], Quirks mode is in effect for a substantial minority of the we crawled the top 100,000 web sites ranked by Alexa [1] 100,000 sites crawled, but of the 260,069 requests for CSS, and identified all of the style sheet resources used by their only 31,681 came from pages in quirks mode. In standards front pages. Our instrumentation reported every style sheet mode, style sheets are always discarded if they are labeled requested while the page itself was loading. This allowed us with the wrong content type; we observed 572 such futile to identify sheets used indirectly via CSS @import directives, requests in our sample. From pages in quirks mode, there and sheets added by JavaScript during page load, as well as were 437 requests for sheets that were labeled with the wrong those referenced directly in the HTML. type; these sheets are honored. The crawler also recorded whether a style sheet was served Results. from the same origin as the requesting HTML document. It From these 100,000 web sites, our crawler logged a total of is most common to serve style sheets from the same origin as 260,069 CSS references, of which 206,051 were same-origin the HTML, but we did observe 54,018 cross-origin requests, and 54,018 cross-origin. We did not include data for sites that 6,075 of which were for pages in quirks mode. Only 74 were unreachable during our evaluation, due to unresponding of those cross-origin requests were labeled with the wrong servers or domain name errors. Our results are shown in content type. Table 2. Finally, the crawler checked whether each sheet began Of these 260,069 requested style sheets, 2,363 returned with a well-formed CSS construct. 1,059 sheets (0.41% of an HTTP error (e.g. 400 Bad Request, 404 Not Found, or the sample) were malformed. (It is interesting to note that a 500 Internal Server Error) rather than a style sheet. These common error among these malformed sheets is to start the resources are unreachable, so they already have no effect on file with an HTML