A newly documented attack technique shows that hackers don’t need JavaScript or file attachments to turn an email into a credential-stealing trap — plain CSS styling code is enough. Dubbed “CSS bomb” attacks, the method was demonstrated by PortSwigger researcher Gareth Heyes against major webmail platforms including Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail, and it can capture a victim’s keystrokes in real time using nothing but formatting rules that email sanitizers are designed to consider safe.

Trusted Formatting, Untrusted Consequences

Webmail providers run incoming HTML and CSS through sanitizers before rendering a message, stripping anything considered dangerous while preserving fonts, colors, and layout. Heyes’s research exposes a gap between what these sanitizers treat as harmless and what browsers actually do with that code once rendered. By combining CSS mutation tricks, attribute selectors, and pseudo-elements such as :before, :after, :has(), and :checked, an attacker can manipulate dropdown menus and form labels to imitate a functioning password field.

When a victim types into what looks like a normal login box, each individual keystroke triggers a distinct CSS rule that quietly fires off a background image request to a server the attacker controls. String enough of those requests together and the attacker has effectively logged the password character by character, all without a single line of JavaScript.

Why This Slipped Past Older Defenses

Earlier attempts at CSS-based keylogging were largely theoretical, because browsers don’t update HTML attributes in response to typing inside a genuine text input. Heyes’s approach sidesteps that limitation entirely by hijacking select elements and labels instead of real input fields, producing a working, real-time credential-capture mechanism that functions even against strict sanitizers like DOMPurify.

Because the attack relies purely on CSS and HTML rather than scripts, it can glide past antivirus tools, spam filters, and script-blocking protections that are tuned to look for JavaScript-based threats specifically.

Proof-of-Concept Attacks Across Major Providers

• Outlook — a CSS “gadget” bug let researchers break out of the email rendering window entirely and spoof a convincing fake Microsoft login screen.
• Fastmail — a technique called “CSS hotwiring” allowed attackers to hijack any click on the page to trigger unintended actions, alongside a separate bug enabling silent read-receipt-style tracking.
• Gmail and ProtonMail — similar image-proxy bypasses were identified, and one proof of concept chained a Gmail flaw together with AI browser prompt injection to exfiltrate Slack authentication tokens through an AI-powered email assistant.

Patched in Some Places, Not in Others

Several of the underlying flaws have already been fixed following responsible disclosure through bug bounty programs, including patches from Fastmail. Others have not: the Outlook label-hijacking bug that enabled the fake login screen reportedly remains unresolved as of this writing.

What Defenders and Users Should Do

Security researchers recommend that webmail providers take several concrete steps to close off this class of bug:

• Render untrusted email content inside sandboxed iframes
• Block automatic loading of remote images by default
• Disallow risky CSS selectors such as :has() and :checked in sanitized content
• Restrict custom HTML attributes that can be abused as sanitizer-bypass gadgets

For individual users, the practical advice hasn’t changed much even though the technique is novel: keep automatic remote image loading turned off where possible, and treat any login prompt that appears inside the body of an email — rather than after clicking through to a verified site — with immediate suspicion. Since this technique produces no obvious visual red flags and bypasses script-focused defenses entirely, that instinct to distrust in-email login forms is currently one of the few reliable safeguards available.