A new class of email-based attacks known as “CSS bomb” exploits common CSS styling in webmail interfaces to hijack user sessions, monitor activity in real-time without using JavaScript or traditional malware This article explores emails sophisticated keyloggers. . These techniques leverage trusted formatting features present in most major webmail platforms, turning HTML emails into sophisticated keyloggers that capture passwords while users type them.
When a victim types into what appears to be a login box, each keystroke triggers a unique CSS rule that silently sends a background image request to an attacker-controlled server, effectively logging every character typed. The new research bypasses this limitation entirely by hijacking select elements and HTML labels instead, creating a fully functional, real-time password-stealing mechanism that works even in emails protected by strict sanitizers like DOMPurify.
Similar bypasses were discovered in Gmail and ProtonMail, with one proof-of-concept even chaining a Gmail vulnerability with AI-driven browser prompt injection to exfiltrate Slack authentication tokens through an AI-powered email assistant. However, some issues like the Outlook label-hijacking bug reportedly remain unresolved. Security experts recommend that webmail providers render untrusted email content inside sandboxed iframes, block automatic image loading, disallow risky CSS selectors such as :has() and :checked, and restrict custom HTML attributes to prevent sanitizer-bypass gadgets from being exploited.
