CSS: The Hidden Threat Lurking in Your Inbox
Black Hat USA 2026 – Las Vegas – Using email platforms to target users is nothing new in the world of threat actors. Nor is it revolutionary for defenders who've shored up guardrails when it comes to suspicious attachments, malicious JavaScript, and more. But as these well-known threats take command of everyone's attention, another vector remains hidden in plain sight.
While HTML is the structure that powers web pages, Cascading Style Sheets (CSS) address design and presentation of the page. From the text to colors and tags to images, CSS manages how a page is displayed. And according to Gareth Heyes, Web security researcher at PortSwigger, it can be weaponized because of its multiple capabilities.
"It's almost like a programming language now," Heyes says. "CSS was on the back burner and largely ignored. [Now] CSS and HTMLalone — no JavaScript, no attachments — are enough to build a...
Copyright of this story solely belongs to darkreading.com. To see the full text click HERE
