# CSS:the bomb inside your inbox

DevFeed: [CSS:the bomb inside your inbox](<https://devfeed.tech/articles/css-the-bomb-inside-your-inbox-7674.md>)

Original publisher: [Read original article](<https://portswigger.net/research/css-the-bomb-inside-your-inbox>)

Author: Gareth Heyes

Published: 2026-08-06T22:00:00Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [modern web development](<https://devfeed.tech/topics/modern-web-development.md>), [Web Development](<https://devfeed.tech/topics/web-development.md>), [passwords](<https://devfeed.tech/topics/passwords.md>)

Tags: [atlas](<https://devfeed.tech/tags/atlas.md>), [browser](<https://devfeed.tech/tags/browser.md>), [bug](<https://devfeed.tech/tags/bug.md>), [css](<https://devfeed.tech/tags/css.md>), [firefox](<https://devfeed.tech/tags/firefox.md>), [html](<https://devfeed.tech/tags/html.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [ui](<https://devfeed.tech/tags/ui.md>)

## AI overview

A security paper on abusing discrepancies between CSS/HTML sanitizers and browser rendering in webmail clients. It describes techniques that can cross trust boundaries, spoof UI actions, exfiltrate tokens, and steal passwords, including an Outlook UI-control issue involving HTML labels.

## Source excerpt

Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this