---
id: 5038
title: "Inline Style Exfiltration: leaking data with chained CSS conditionals"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/inline-style-exfiltration"
published_at: "2025-08-27 07:35"
tags: ["chromium", "exfiltration", "css", "css-injection", "inline-styles", "data-theft"]
phying_url: "https://phying.com/item/5038"
lang: en
---

# Inline Style Exfiltration: leaking data with chained CSS conditionals

## Summary

Chained CSS if() conditionals in inline styles exfiltrate attribute data such as usernames via background requests — no selectors or stylesheet imports needed; Burp actions brute-force values.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-08-27 07:35
- **Original:** https://portswigger.net/research/inline-style-exfiltration
- **Phying News:** https://phying.com/item/5038