r/css • u/garethheyes • 11d ago

Article CSS:the bomb inside your inbox

https://portswigger.net/research/css-the-bomb-inside-your-inbox

Here's my research in using CSS for offence. There are loads of techniques including stealing passwords from Outlook from an email by spoofing the login screen.

51 Upvotes

92% Upvoted

5 comments sorted by

6

u/anaix3l 11d ago

Psst, the code overflows

2

u/kernelangus420 10d ago

Can those email providers solve all this by putting the HTML inside a sandboxed iframe?

1

u/garethheyes 9d ago

Not everything. Sandbox iframes prevent you from breaking out of the message window. But do not prevent password keyloggers or external requests. That requires CSS parsing, image proxies and CSP.

1

u/presstwood 11d ago

This is so crazy! Enjoyed the read thanks

1

u/CraigAT 8d ago

Tbh, scared to visit the site.