CSS The Bomb Inside Your Inbox

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://portswigger.net/research/css-the-bomb-inside-your-inbox
• Blog Title: CSS: The Bomb Inside Your Inbox
• Suggested Section: Pentesting Web > XS-Search/XS-Leaks > CSS Injection, with cross-references from Clickjacking, Content Security Policy Bypass, and AI Security > AI Agent/Indirect Prompt Injection

🎯 Content Summary

Overview

Published on August 6, 2026, Gareth Heyes' research demonstrates that sanitized CSS and HTML in webmail cannot safely be treated as merely visual content. By exploiting differences between sanitizers, browser parsers, CSSOM serialization, image proxies, CSP, and post-sanitization JavaScript, attacker-controlled email content can cross trust boundaries and affect the surrounding application. Tested targets include Outlook, Fastmail, Gmail, Yahoo Mail, AOL Mail, Proton Mail, Fi...

🔧 Technical Details

Label-based UI activation: When sanitized untrusted HTML retains <label for="id">, the label may activate a trusted control outside the untrusted content boundary. Enumerate labelable controls with document.querySelectorAll('input[id],button[id],select[id],textarea[id]') and test whether their IDs can be referenced from attacker-controlled markup. This can invoke existing application actions without JavaScript.

Human/AI rendering disparity: Place benign human-facing content in CSS-generated :before or :after text that an AI agent does not interpret equivalently, while storing malicious instructions in nearly transparent ordinary HTML that the AI can read. A trigger phrase can cause the agent to extract page data and encode it into navigations. Explicitly listing destinations may also affect an agent's confirmation checks.

Clipboard sanitization race: Put an inline...

🤖 Agent Actions

Updated src/pentesting-web/xs-search/css-injection/README.md.

Added a new cited section covering:

• label-based trusted UI activation from sanitized email HTML
• CSS-only clickjacking / pseudo-element hotwiring
• sanitizer differentials, image-proxy/CSP bypass primitives, and CSSOM mutation
• clipboard contenteditable race + compact 12-hex token exfil
• select-based CSS keylogging, font-metric click exfil, and AI rendering disparity

Also appended references:

• PortSwigger blog post
• PortSwigger materials repo

Validation:

• checked the inserted section and reference numbering
• verified internal link paths used in the new content
• mdbook build could not be run because mdbook is not installed in this environment

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://portswigger.net/research/css-the-bomb-inside-your-inbox

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > XS-Search/XS-Leaks > CSS Injection, with cross-references from Clickjacking, Content Security Policy Bypass, and AI Security > AI Agent/Indirect Prompt Injection".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0