Collected research

Protecting Browsers from Cross-Origin CSS Attacks

Lin-Shung Huang, Zack Weinberg, Chris Evans and Collin Jackson · linshunghuang.com

CSS error-tolerant parsing lets an attacker bracket secret text in a victim page with an injected style-rule prefix and suffix, import that page cross-origin as a stylesheet, and read the secret back out - with no JavaScript, using background-image URLs. Working attacks are shown on IMDb, Yahoo! Mail and Hotmail.

Record

Researcher

Lin-Shung Huang, Zack Weinberg, Chris Evans and Collin Jackson

Published by

linshunghuang.com

Format

Whitepaper

Topic

Browser

In the archive

• Collected in the 2010 research round

Tags

• css
• same-origin-policy
• sop-bypass
• info-leak
• content-type
• parser-differential
• mitigation
• measurement-study
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Lin-Shung Huang, Zack Weinberg, Chris Evans and Collin Jackson, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.