DigiNews

Summary

PortSwigger's CSS the bomb inside your inbox reveals how webmail clients render untrusted CSS/HTML and how attackers can exfiltrate tokens, bypass image proxies, and weaponize CSS to deface UI or steal passwords. It covers techniques, real-world targets (Outlook, Fastmail, Gmail, ProtonMail, Slack), defenses, and future attack ideas.