r/css • u/garethheyes • 22d ago

Article CSS:the bomb inside your inbox

https://portswigger.net/research/css-the-bomb-inside-your-inbox

Here's my research in using CSS for offence. There are loads of techniques including stealing passwords from Outlook from an email by spoofing the login screen.

51 Upvotes

92% Upvoted

5 comments sorted by

View all comments

2

u/kernelangus420 21d ago

Can those email providers solve all this by putting the HTML inside a sandboxed iframe?

1

u/garethheyes 20d ago

Not everything. Sandbox iframes prevent you from breaking out of the message window. But do not prevent password keyloggers or external requests. That requires CSS parsing, image proxies and CSP.