Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CSS:the bomb inside your inbox

portswigger.net | research | #ai-security | #browser-security | #data-exposure | #prompt-injection | #web-security | #email-security | #webmail | #css | #sanitization-bypass | #token-exfiltration

Summary

PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
Published
Collected

original ↗

Related coverage

research · portswigger.net
One XSS cheatsheet to rule them all
Gareth Heyes launches PortSwigger's XSS cheatsheet, packed with novel filter-bypass vectors such as :target CSS transitions and hash-triggered focus events, each with a hosted PoC.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Inline Style Exfiltration: leaking data with chained CSS conditionals
Chained CSS if() conditionals in inline styles exfiltrate attribute data such as usernames via background requests — no selectors or stylesheet imports needed; Burp actions brute-force values.
research · portswigger.net
Splitting the email atom: exploiting parsers to bypass access controls
Email parser discrepancies — quoted values, Unicode overflows, encoded-word, malformed Punycode — become access control bypasses and RCE, with cases against GitHub, Zendesk, GitLab and Joomla.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
back