Security researcher Gareth Heyes has unveiled a new class of webmail-based attacks that exploit HTML and CSS rendering behaviors to manipulate user interfaces, leak sensitive data, and even capture user credentials.
The research highlights how modern email clients, which rely heavily on web technologies to display messages, can become unintended attack surfaces when inconsistencies arise between content sanitization and browser rendering.
Webmail providers such as Gmail, Outlook, Yahoo Mail, Fastmail, AOL Mail, and Proton Mail typically sanitize incoming HTML and restrict CSS properties to prevent malicious behavior.
New CSS Bomb Attack Exposes Gmail, Outlook
However, Heyes discovered that discrepancies between how sanitizers interpret CSS and how browsers ultimately process it can introduce exploitable gaps.
These inconsistencies allow attackers to craft seemingly harmless email content that transforms into malicious code when rendered in a user’s browser.
One of the most notable techniques introduced in the research is the concept of “CSS Bomb” attacks. These attacks leverage the CSS Object Model (CSSOM), where sanitized input can mutate into unsafe structures after being parsed by the browser.
In such cases, content deemed secure during filtering may later be reconstructed into dangerous syntax, bypassing existing defenses. This opens the door to a variety of exploitation methods, depending on the email service and its implementation.
A particularly concerning attack vector involves the use of CSS selectors to extract sensitive information. Attackers can design CSS rules that test fragments of hidden values, such as authentication tokens embedded in links or page elements.
When a match occurs, the browser triggers an external resource request (for example, loading a background image), allowing attackers to infer parts of the sensitive data based on observed requests. This method is especially effective against short hexadecimal tokens under specific conditions.
Heyes also identified vulnerabilities related to user interaction, including a paste-handling race condition in Yahoo Mail and AOL Mail. In this scenario, an attacker tricks a victim into pasting malicious rich content into an email draft.
Due to timing issues in how pasted content is processed and sanitized, sensitive information, such as login tokens present in the draft, can be exposed before proper filtering occurs.
Another area of concern is the bypassing of image proxy protections. Many email providers use proxy servers to prevent senders from tracking when an email is opened or identifying a recipient’s IP address.
However, quirks in CSS parsing and sanitization can trigger external requests that circumvent these protections, weakening user privacy and enabling tracking.
The research further demonstrates how trusted interface elements can be manipulated. In Microsoft Outlook, for example, certain allowed labels could potentially be linked to form controls via IDs, enabling malicious emails to trigger unintended interface actions.
Additionally, “CSS gadgets” elements introduced by application JavaScript that are not accounted for in sanitization rules, can be abused to overlay or alter the mailbox interface, increasing the risk of phishing attacks.
One of the most advanced demonstrations involves credential theft using CSS-driven interactions. Instead of traditional keylogging techniques, which often fail due to limitations in tracking live input values, the attack leverages browser behaviors tied to selectable options.
By creating a convincing spoofed login interface within an email, attackers can capture user input through indirect CSS-based mechanisms.
To mitigate these risks, experts recommend that email providers treat all HTML and CSS content as untrusted. This includes enforcing strict CSS allow lists, improving URL parsing, isolating untrusted content from core interfaces, and revalidating CSSOM output after browser processing.
For users, best practices include avoiding pasting content from untrusted sources, being cautious of unexpected login prompts within emails, and enabling phishing-resistant multi-factor authentication.
Heyes’s findings underscore the evolving complexity of web-based threats and highlight the need for continuous improvements in email security architectures.
No Comment! Be the first one.