CSS:the bomb inside your inbox
Published: Thursday, 6 August 2026 at 22:00 UTC Updated: Thursday, 13 August 2026 at 09:21 UTC – – It’s quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this paper I’m going to show you how to break out of trust … Read more