# Inline Style Exfiltration: leaking data with chained CSS conditionals

DevFeed: [Inline Style Exfiltration: leaking data with chained CSS conditionals](<https://devfeed.tech/articles/inline-style-exfiltration-leaking-data-with-chained-css-conditionals-7683.md>)

Original publisher: [Read original article](<https://portswigger.net/research/inline-style-exfiltration>)

Author: Gareth Heyes

Published: 2025-08-26T12:54:03Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [CSS](<https://devfeed.tech/topics/css.md>), [browsers](<https://devfeed.tech/topics/browsers.md>), [Chromium](<https://devfeed.tech/topics/chromium.md>), [selectors](<https://devfeed.tech/topics/selectors.md>)

Tags: [browsers](<https://devfeed.tech/tags/browsers.md>), [chromium](<https://devfeed.tech/tags/chromium.md>), [code](<https://devfeed.tech/tags/code.md>), [css](<https://devfeed.tech/tags/css.md>)

## AI overview

The article presents a CSS injection technique that exfiltrates attribute data through inline styles, without selectors or stylesheet imports. It uses CSS conditionals, nested comparisons, and background requests to test possible values, with Burp Suite Custom Actions helping brute-force non-complex data such as user IDs and usernames. The technique reportedly works only in Chromium-based browsers at the time of writing.

## Source excerpt

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: Someone asked if you c