CSS: The Hidden Threat Lurking in Your Inbox
Dark Reading, Wednesday, August 5th, 2026
Researchers warn CSS alone is now powerful enough to build working keyloggers and exfiltrate webmail data.
PortSwigger web security researcher Gareth Heyes told Black Hat USA 2026 that CSS has grown powerful enough to function almost like a programming language, and that CSS plus HTML alone, with no JavaScript or attachments, suffice to build a working keylogger.
CSS-based attacks take more effort than traditional email exploits but bypass script execution controls and attract far less scrutiny. Users cannot turn CSS off, so responsibility falls on webmail vendors to isolate messages and sanitize CSS so it cannot break out of a message's trust boundary.
Heyes found hijacking bugs and advanced attack methods in well-known platforms, and reports that some vendors fixed the issues quietly after initially dismissing his disclosures.