CSS 'Bomb' Attack Vector Exploits Webmail Sanitization Flaws for Code Execution
Researchers have discovered a novel attack vector using CSS to execute arbitrary code within webmail clients by exploiting sanitization flaws, bypassing traditional security measures.
Researchers have uncovered a novel and potent attack vector that leverages Cascading Style Sheets (CSS) to execute arbitrary code within the trusted environment of webmail clients. This technique, dubbed "CSS:the bomb inside your inbox," exploits discrepancies between how CSS sanitizers interpret code and how web browsers actually render it, allowing attackers to bypass established security controls.
The core of the attack lies in the sanitization process employed by webmail services. These services often allow users to include custom CSS within their emails, a feature intended for legitimate formatting but which can be weaponized. Attackers can craft malicious CSS that, while appearing benign to a sanitizer, is interpreted by the browser in a way that breaks out of trust boundaries. This can lead to a range of malicious outcomes, including cross-site scripting (XSS) attacks, token exfiltration, and even the compromise of third-party websites.
One of the demonstrated techniques involves abusing HTML labels and CSS pseudo-elements like :before and :after. By carefully crafting CSS, an attacker can manipulate the content displayed to a user or, more critically, to an AI browser. This allows for indirect prompt injection, where the AI interprets malicious instructions hidden from the human user, potentially leading to account takeover or unauthorized actions. For instance, an attacker could present one message in French to a user while an AI browser, tasked with translation, receives entirely different, malicious instructions.
Further exploitation methods include defacing email clients like Outlook by injecting malicious CSS gadgets, and a technique called "CSS hotwiring" which can hijack UI actions. The research highlights specific vulnerabilities found in popular webmail clients such as Fastmail, Outlook, Yahoo Mail, AOL Mail, ProtonMail, and Gmail. In one example, a crafted email could manipulate Outlook's UI to pin a malicious message to a victim's inbox, demonstrating a direct impact on user interaction within the trusted application.
The attack's effectiveness is amplified by its ability to exfiltrate sensitive tokens even when Content Security Policy (CSP) is actively blocking external resources. By exploiting syntax quirks and image proxy bypasses within CSS, attackers can force the webmail client to make requests that leak valuable information. This bypasses a critical layer of defense designed to prevent data leakage.
Beyond token theft, the research details methods for stealing passwords and tracking email opens. By combining image proxy bypasses with indirect prompt injection, attackers can trick AI models into revealing sensitive information or performing actions on behalf of the user. The research also touches upon the potential for creating HTML-only keyloggers and even real-time keyloggers within the browser context, further expanding the attack surface.
The findings underscore a critical gap in the security of modern webmail clients and the broader ecosystem of applications that render untrusted HTML and CSS. While sanitizers aim to protect users, the complexity of web standards and browser rendering engines creates persistent opportunities for exploitation. The researchers emphasize the need for more robust sanitization techniques and a deeper understanding of how different rendering engines interpret CSS.
This research serves as a stark reminder that even seemingly innocuous styling elements can be weaponized. As web applications become more complex and integrate AI features, the potential for novel attack vectors like CSS bombs will continue to grow, demanding constant vigilance and adaptation from security professionals.