Inline Style Exfiltration: leaking data with chained CSS conditionals
Summary: PortSwigger researcher Gareth Heyes published a technique on 26 August 2025 for stealing attribute data through inline CSS styles alone, without selectors or stylesheet imports, by chaining CSS if-statement conditionals to test attribute values and trigger background requests to an arbitrary domain. The method requires double quotes in the if-statement comparison, can brute-force non-complex data such as user IDs or usernames one value at a time through nested conditionals, and at the time of writing works only on Chromium-based browsers.
Bottom line: CSS injection was previously treated as low-impact without a stylesheet import, and this technique turns a single style attribute into a channel that can leak values like user IDs and usernames to any domain the attacker chooses.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026