Collected research

Code Vulnerabilities Put Skiff Emails at Riskr

Code Vulnerabilities Put Skiff Emails at Risk

Paul Gerste · sonarsource.com · 12 September 2023

Skiff's webmail inserted a div into the already-sanitized DOM inside an svg element; because a div is not a valid svg child, re-serializing and re-parsing the HTML moved the style element out of SVG context, so an img onerror hidden in an attribute came alive, a mutation XSS past DOMPurify.

Record

Document

Code Vulnerabilities Put Skiff Emails at Risk

Researcher

Paul Gerste

Published by

sonarsource.com

Date

12 September 2023

Topic

Other

In the archive

• Collected in the 2023 research round

Related sources

• Code Vulnerabilities Put Proton Mails at Risk
• Talk recording
• Foundational CSP-bypass demonstration

Tags

• mutation-xss
• sanitizer-bypass
• parser-differential
• xss
• csp
• css
• info-leak
• iframe
• cloudflare
• email
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Paul Gerste, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.