Preliminary research

Smashing the token limit with overlapping fragments

Alex and Gareth Heyes · PortSwigger Research · 5 October 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Uses overlapping CSS-leaked fragments as a graph to reconstruct a secret token when enumerating every possible order is infeasible.

Record

Researcher

Alex and Gareth Heyes

Published by

PortSwigger Research

Date

5 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Earlier CSS exfiltration research

Tags

• css-injection
• token-theft
• data-exfiltration
• graph
• prior-art-extension
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Alex and Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.