A security researcher has demonstrated that Cascading Style Sheets (CSS) technology can also be abused to steal sensitive information from webmail users.

 

What happened

According to Dark Reading, research presented by Gareth Heyes, a web security researcher at PortSwigger, at Black Hat USA 2026 indicates an overlooked attack surface in modern webmail platforms. Heyes warned that as browsers continue adding capabilities to CSS and HTML, attackers could find new ways to exploit those features against users.

 

Going deeper

CSS, or Cascading Style Sheets, is primarily used to control how web pages look, including their text, colors, images and other visual elements. However, Heyes found that its capabilities have evolved to the point where CSS and HTML can be abused for malicious purposes.

In particular, Heyes demonstrated that CSS and HTML alone can be used to build a functioning keylogger capable of stealing sensitive information, without relying on JavaScript or malicious attachments.

The research raises concerns for webmail platforms because users generally cannot disable CSS when viewing their inboxes. This means that if malicious CSS is able to escape the boundaries of an email and interact with the surrounding webmail application, users may have little ability to protect themselves.

 

What was said

“It's almost like a programming language now,” Heyes told Dark Reading, describing the evolution of CSS.

He said CSS had previously been “on the back burner” from a security perspective but warned that CSS and HTML alone can now be sufficient to build a working keylogger capable of stealing sensitive information. Heyes also cautioned that the growing capabilities of browsers could increase the problem. “As you add those features, the attack surface grows,” he said.

The researcher said the responsibility for mitigating the threat largely falls on webmail providers because ordinary users have few practical ways to protect themselves from malicious CSS.

He recommended that webmail platforms isolate email messages so that their content cannot interfere with the rest of the application. Providers can also strengthen CSS sanitization to prevent malicious content from escaping the boundaries of an individual message.

Heyes further suggested that security teams use image proxies as another layer of protection.

 

The bigger picture

Gareth Heyes told Dark Reading that CSS has evolved significantly, becoming powerful enough to act almost like a programming language. He demonstrated that CSS and HTML can be misused to create a keylogger without JavaScript or attachments. For email providers, this means ensuring that content inside an email cannot interfere with the rest of a user's inbox or account. Heyes said webmail providers can “basically isolate the messages” so they cannot interfere with the rest of the page. He also recommended stronger checks on CSS to prevent potentially harmful content from escaping the boundaries of an email.

The challenge is that CSS is commonly used in legitimate emails, including newsletters and marketing messages. Simply blocking it could affect how these emails look and function. Instead, providers need to find ways to allow legitimate formatting while preventing it from being misused.

The issue could become more important as web browsers continue to introduce new features. “As you add those features, the attack surface grows,” Heyes told Dark Reading.

For users, there is also a practical limitation. “You can’t turn off CSS,” Heyes said. This places much of the responsibility on email providers to make sure that messages are safely displayed.

 

Why it matters

The findings reinforce the importance of treating email content as untrusted and isolating it from the broader application environment.

The issue also exposes a broader challenge for browser and web application security. As web technologies become more capable, their functionality can create new opportunities for attackers.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQS

Does this mean every email containing CSS is dangerous?

No. CSS is commonly used for legitimate purposes, including formatting newsletters and other emails. The concern is that attackers could abuse certain capabilities of CSS for malicious purposes.

 

Does the attack work on all email services?

The effectiveness of the technique depends on how an email platform processes and displays HTML and CSS, as well as the security measures it has in place.

 

Is this an immediate threat to ordinary email users?

The research points to a potential attack technique rather than suggesting that every email user is currently being targeted. However, it demonstrates why email providers need to stay ahead of emerging ways that legitimate web technologies could be abused.