Preliminary research
CSS: the bomb inside your inbox
AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.
Webmail sanitizers and browsers disagree about CSS. Nested href attribute selectors, sped by a clipboard-paste race, leak a Medium login token five characters at a time; when CSP blocks requests, @font-face descent-override plus animations form a font-height oracle and inset reveals the matching link. Fastmail's CSSOM filter re-serialises \7d\2a into }*, Outlook's accepts @media --narrow-window;/*"*/ arbitrary CSS, giving click hijacking, prompt injection and a keylogger.
Record
- Researcher
- Gareth Heyes
- Published by
- PortSwigger Research
- Date
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.