Security Researcher Unveils CSS-Based CSP Bypasses Threatening Major Webmail Providers

LONDON, Aug. 8 (AP) — A new security vulnerability affecting major webmail providers allows attackers to bypass Content Security Policy protections using advanced Cascading Style Sheet techniques, potentially enabling the theft of passwords and authentication tokens.

Gareth Heyes, a researcher at PortSwigger, disclosed on Friday that multiple attack vectors exist within current CSS implementations. The findings demonstrate how malicious actors can exploit these flaws to exfiltrate sensitive user data or hijack artificial intelligence tools integrated into email platforms. The vulnerabilities specifically target the mechanisms web browsers use to enforce security policies designed to prevent cross-site scripting and other injection attacks.

The research details a series of methods where attackers inject custom CSS code that manipulates how content is rendered on a page. By altering visual elements or triggering specific browser behaviors, these techniques can circumvent restrictions intended to block unauthorized data access. Heyes noted that the exploits are effective across several leading email services, posing a significant risk to users who rely on web-based interfaces for secure communication.

The implications extend beyond simple credential theft. The disclosed methods include scenarios where attackers could compromise AI-driven features within these platforms. These tools, increasingly used for summarizing emails or generating responses, could be manipulated into processing malicious inputs if the underlying security policies are bypassed. This creates a pathway for data leakage that traditional filters may not detect.

Webmail providers have not yet issued public statements regarding specific patches in response to the disclosure. The industry typically follows a coordinated vulnerability disclosure timeline, where researchers work with vendors privately before making findings public to allow time for remediation. However, no official confirmation of fixes has been released as of Friday morning.

The attack relies on the complex interaction between CSS rendering engines and browser security policies. Unlike traditional exploits that target code execution directly, these techniques leverage styling rules to manipulate user perception or trigger unintended system actions. This distinction makes detection difficult for standard intrusion prevention systems focused on script analysis rather than style sheet anomalies.

Security experts warn that until patches are widely deployed, users of affected platforms remain exposed. The vulnerability highlights the evolving nature of web-based threats as attackers adapt their methods to target less scrutinized areas of browser functionality. As AI integration deepens within email services, the potential impact of such bypasses grows more severe.

Questions remain regarding the full scope of organizations impacted and whether similar vulnerabilities exist in other web applications beyond major email providers. Researchers are currently analyzing if these techniques can be adapted for use against different types of Content Security Policy configurations across the broader internet ecosystem.