Skip to content
Blind CSS Exfiltration: exfiltrate unknown web pages
portswigger.net | research | #web-security | #csp-bypass | #exfiltration | #css | #blind-injection | #css-injection
Summary
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
- Published
- Collected