Committing CSS Crimes for fun and profit

The talk traces how users of a social media site pushed inline styling into "CSS crimes": posts that behave like games, operating systems and animations using only HTML and CSS. The speaker then asks whether styles in an email can escape the mail client and affect the page around it.

The middle section examines several webmail providers in turn. A regex-based sanitizer at one provider missed whitespace variants inside CSS escape sequences, which let a background image load and leaked the reader's IP address and browser headers. Another provider's string-based filter ignored quote context and comments, enabling CSS injection that could drive a hidden multi-step action in a demo. A parser-based sanitizer at FastMail was sounder, but an off-by-one error in selector splitting still allowed injected selectors and rules. Each finding was reported to the vendor, with fix times and bounties described.

The final part covers SVG filters, which cannot export their computed pixel data directly. The speaker shows click-checking attacks that detect hover states and chain logic inside filters, demonstrated against a Google Docs flow and a Google Pay widget that leaked digits. The last technique encodes data into a QR code generated entirely inside an SVG filter, so a victim only needs to scan it. The takeaway is that string-based sanitizers are fragile, and that strict content security policies and parser-based filtering matter.