Thought Leadership

Black Hat USA 2026 – Las Vegas – Using email platforms to target users is nothing new in the world of threat actors. Nor is it revolutionary for defenders who've shored up guardrails when it comes to suspicious attachments, malicious JavaScript, and more. But as these well-known threats take command of everyone's attention, another vector remains hidden in plain sight.

While HTML is the structure that powers web pages, Cascading Style Sheets (CSS) address design and presentation of the page. From the text to colors and tags to images, CSS manages how a page is displayed. And according to Gareth Heyes, Web security researcher at PortSwigger, it can be weaponized because of its multiple capabilities.

"It's almost like a programming language now," Heyes says. "CSS was on the back burner and largely ignored. [Now] CSS and HTML alone — no JavaScript, no attachments — are enough to build a working keylogger" stealing sensitive and confidential user information.

Design Discoveries

Heyes first discovered the red flags when he was looking into designing his own website, experimenting with personal projects, and uncovering how much power CSS had, especially when used maliciously.

But despite its well of potential threats, CSS-based attacks still require more effort than the traditional email-based exploits.

"You've got to work a bit harder because although [CSS is more] powerful, it takes more work to work out how to get data out of there using animations and that sort of thing," he adds.

Though this field remains largely untapped, Heyes believes that CSS-based attacks will become the next big frontier due to the fact that they can bypass executing script and because people aren't paying enough attention.

"What the browsers are doing all the time is adding new features to CSS, to HTML," notes Heyes. "But the problem is, as you add those features, the attack surface grows."

CSS Is Here to Stay

As for seeing these kinds of vulnerabilities and attacks in the wild, Heyes plans on revealing his findings during his briefing at Black Hat USA this week, but confirms that he found flaws in big names that many will be familiar with.

And the responsibility ultimately lies with these companies, as there's not much users can do on their end unless they happen to have knowledge of HTML and CSS at their disposal.

When a user receives an email with malicious CSS display features while using webmail, they're effectively locked in.

"You can't turn off CSS," says Heyes. "But from a webmail perspective, you can basically isolate the messages using a technology so that it can't interfere with the rest of the page. And webmail can also produce a more effective sanitization of the CSS in order to prevent it from leaking out of the page, breaking out of the trust boundaries of the message."

What he hopes for moving forward is that these webmail vendors will correctly filter and sanitize their user displays and that security teams will use an image proxy to protect users — guardrails that are clearly necessary considering Heyes says that in his research he's found hijacking bugs, various advanced attacks methods, and even bugs in vendors' webmail platforms.

This hope may be misplaced, however, as Heyes' research journey reveals a troubling pattern in how major email platforms handle security disclosures. Some vendors responded swiftly and transparently. Others dismissed the findings entirely, only to quietly implement fixes later without acknowledgment.

So, while some are ready to face the new frontier, others are seemingly more comfortable not acknowledging its realities. But with research showing that it's already here, it appears that CSS and its attack surface isn't waiting for anyone.