How CSS Alone Can Steal Your Private Emails

Attackers can read your emails using nothing but CSS. For years, security teams have focused almost entirely on blocking malicious JavaScript. They assume that if scripts are disabled or sanitized, the email client is safe. But that's left a massive backdoor wide open. It's called stylesheet injection. When webmail doesn't properly sanitize user-submitted CSS, it exposes users to a silent, highly effective side-channel attack. By using standard CSS features, an attacker can pull sensitive information right off the page. They bypass traditional script-based defenses completely. Here's how the heist works. The attack relies on CSS attribute selectors. These selectors match specific characters in target data, like a security token or a piece of text. For instance, say an input field contains a secret. The CSS checks if that value starts with the letter A. If it matches, the browser is told to load a background image from the attacker's external server. That's how the character gets sent out. To handle sequential imports, attackers dynamically load new style blocks after they steal each character. Since CSS is usually parsed just once, they use sequential stylesheet loading. When the browser requests the background image for the first character, the attacker's server responds with a new stylesheet. That new sheet looks for the second character. This loop goes on until the entire string leaks, character by character. This method also bypasses the Content Security Policy. Since these attacks don't run any script code, they slip right past standard filters meant for cross-site scripting. Which is pretty wild if you think about it. Plus, if a webmail service has a lenient Content Security Policy that allows stylesheet loading or image requests to external domains, the data leaks completely unrestricted. If you're a developer or a security researcher, it's time to audit your sanitization pipelines. Don't treat CSS as harmless styling. Implement strict content security policies. Restrict external imports. Make sure your HTML sanitizers strip dangerous style elements. Head over to our website to read the full security breakdown and protect your users today.