CSS Inline Styles Can Exfiltrate Webmail Data
PortSwigger researchers demonstrated that CSS conditionals in inline style attributes can read email DOM attributes and fire background requests, stealing data from webmail clients. The technique works in Chromium browsers and bypasses typical CSS sanitization, exposing a new vector for credential and content leakage. Email services must tighten CSS filtering.