---
id: 5068
title: "Blind CSS Exfiltration: exfiltrate unknown web pages"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/blind-css-exfiltration"
published_at: "2024-07-11T10:09:00Z"
tags: ["web-security", "csp-bypass", "exfiltration", "css", "blind-injection", "css-injection"]
phying_url: "https://phying.com/item/5068"
lang: en
---

# Blind CSS Exfiltration: exfiltrate unknown web pages

## Summary

Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2024-07-11T10:09:00Z
- **Original:** https://portswigger.net/research/blind-css-exfiltration
- **Phying News:** https://phying.com/item/5068