https://hackingpassion.com/tags/css/Recent content in CSS on HackingPassion.com : root@HackingPassion.com-[~]HugoenSat, 08 Aug 2026 14:35:36 +0200https://hackingpassion.com/css-webmail-keylogger-outlook/Sat, 08 Aug 2026 14:35:36 +0200https://hackingpassion.com/css-webmail-keylogger-outlook/<p>CSS in an email put a fake Microsoft sign-in over a live Outlook inbox and read the password letter by letter. Opening the message is enough. Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail and AOL Mail gave way. 🧐</p> <p><strong>Microsoft and Google still have not fixed their part.</strong></p> <p>Webmail has a problem it has never fully solved. Someone sends you HTML, and that HTML has to be displayed inside a page that also holds your inbox, your buttons and your account. To handle that, webmail runs the message through a sanitizer, which strips or rewrites anything it considers dangerous and hands what is left to the browser. The weak spot sits in that word, <em>considers</em>. A sanitizer has its own reading of the HTML and CSS, the browser has another, and where those two readings differ you get a gap. Some clients go a step further and let the browser parse the message first, then filter what the browser produced. That output can be pushed back into something malicious too.</p>