portswigger.net

CSS:the bomb inside your inbox | PortSwigger Research

Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this

If the page stays blank, open it in a new tab. Your Weird rating still works from the top bar.

Open source