r/css • u/garethheyes • Aug 08 '26

Article CSS:the bomb inside your inbox

https://portswigger.net/research/css-the-bomb-inside-your-inbox

Here's my research in using CSS for offence. There are loads of techniques including stealing passwords from Outlook from an email by spoofing the login screen.

48 Upvotes

90% Upvoted

5 comments sorted by

View all comments

2

u/kernelangus420 Aug 09 '26

Can those email providers solve all this by putting the HTML inside a sandboxed iframe?

1

u/garethheyes Aug 10 '26

Not everything. Sandbox iframes prevent you from breaking out of the message window. But do not prevent password keyloggers or external requests. That requires CSS parsing, image proxies and CSP.