New CSS Bomb Attacks Let Hackers Steal Passwords and Tokens From Webmail Users

Security researcher Gareth Heyes has revealed techniques for webmail attacks that exploit HTML and CSS, the technologies used to format emails, to manipulate user interfaces, leak authentication data, and in some cases, capture passwords.

Webmail services need to display HTML controlled by the sender without compromising the security of the mailbox application. To achieve this, providers sanitize the markup and restrict certain CSS properties.

New CSS Bomb Attacks

Heyes identified that discrepancies between how a sanitizer interprets CSS and how a browser ultimately renders it can create exploitable vulnerabilities.

Products that process browser-parsed CSS through the CSS Object Model (CSSOM) may also be susceptible to mutations: input deemed safe can be reconstructed into unsafe syntax.

Heyes’s research evaluated several services, including Outlook, Gmail, Fastmail, Yahoo Mail, AOL Mail, and Proton Mail. The impact of the vulnerabilities varies by service and technique, and some reported flaws were addressed after the disclosure.

However, Heyes noted that certain issues persisted at the time of publication, including a UI issue in Outlook and a Gmail technique that could trigger remote requests via CSS.

One class of attack utilizes CSS selectors to test fragments of sensitive values embedded in links or page elements. A match can result in a background or image request, allowing an attacker to infer parts of a token from requests sent to an external server.

The research demonstrates this concept using email login links and states that it may affect short hexadecimal tokens under specific conditions.

Another scenario begins when a victim pastes malicious rich content into a webmail draft. Heyes describes a paste-handling race condition in Yahoo Mail and AOL Mail. If an attacker persuades a victim to paste crafted clipboard content, the attacker could expose a sensitive login token contained in the draft.

The research also discusses image-proxy bypasses. These proxies aim to hide a recipient’s IP address and prevent senders from determining when an email was opened. Quirks in CSS parsing and sanitization failures could generate external requests, weakening these privacy protections.

The most critical demonstrations combine weaknesses in sanitizers with trusted-interface behavior. In Outlook, allowed labels could potentially be linked to form controls by ID, enabling an email to trigger actions in the interface.

Heyes also identified “CSS gadgets,” where application JavaScript adds elements or style behavior not accounted for in the email sanitizer’s intended allow list. An attacker might exploit this behavior to overlay or alter the mailbox UI.

The research illustrates password-capture concepts using a spoofed sign-in screen and CSS-driven interactions. It notes that many so-called CSS keyloggers fail because typing changes an input’s live DOM value, not its HTML attribute.

Instead, the proof of concept relied on browser behavior related to selectable options, demonstrating how a CSS-only interface control can lead to credential theft.

Providers should regard email HTML and CSS as potentially hostile content. Key priorities include implementing strict CSS allow lists, robust URL parsing, isolating untrusted content from trusted interfaces, and revalidating CSSOM output before reuse.

Users should avoid pasting rich content from untrusted sources into drafts, remain suspicious of unexpected sign-in prompts within webmail, and utilize phishing-resistant multi-factor authentication (MFA).

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world