I stole an Outlook password with nothing but CSS inside an email 👀 Whitepaper below 👇

This video is from my research "CSS: the bomb inside your inbox". Whitepaper & slides:

Outlook renders untrusted CSS inside the trusted mail UI. The breakout is a gadget in Outlook's own code: an allow-listed data attribute causes it to append position:fixed, which lets the message cover the chrome with a fake login form.

Microsoft: that's a feature.

Amazing. That's like making a helicopter out of scrap metal.

@WebSecAcademy Waiting for css for hackers book edition 🙃

@WebSecAcademy I might do that at some point 😀

@WebSecAcademy

“No JavaScript” does not mean “no active content.” If untrusted email CSS shares a rendering context with trusted webmail controls, sanitizer quirks can become UI manipulation or credential theft. Strong isolation, such as sandboxed rendering, matters more than an ever-growing CSS blocklist.

Wild that you pulled this off with just CSS 👀 Makes you think twice about every email you open. How long did this take you?

A lot of testing. Many months.

next level stuff 🔥🔥🔥🔥🔥🔥🔥🔥🔥

Its over for grandmas around the world

Coooool