# CSS injection data exfiltration

User-controlled CSS reading attribute values and leaking them via selector-triggered external requests

_Area: Web injection and code execution. Seen in 4 disclosed reports; one confirmed bounty: $500; latest 2026-10-05. Updated 2026-10-23._

## How it works
CSS is treated as presentation, not code, so it is often allowed where scripts are stripped. But CSS can read attribute values through selectors and can make the browser fetch URLs. If an attacker controls any CSS that applies to a page holding a secret (an input's `value`, a token in an attribute), selectors like `[value$="x"]` reveal whether a guessed substring is present, and a `background-image: url(...)` fires an outbound request only when the selector matches. The broken assumption is that CSS cannot observe or transmit data. It can, one guess at a time. Note that attribute selectors only match values actually present in the parsed/rendered DOM, not arbitrary JavaScript state.

## Where it shows up
- Custom themes, skins, or user profile CSS rendered unsanitized in a client that loads external images [E2](https://bugbountylibrary.com/r/blog%3Afletchto99-dev-2019-november-slack-vulnerability.md)
- Inline `style` attributes reachable by injection, where `attr()` and `if()` still branch on values [E3](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-inline-style-exfiltration.md)
- Any sink that echoes user input into a `<style>` block or style attribute
- Parameters concatenated into a CSS file URL, where `../` reaches same-origin endpoints or an open redirect [E4](https://bugbountylibrary.com/r/h1%3A1245165.md)
- Secrets placed in DOM attributes (input values, data-* tokens) on pages sharing origin with injected CSS

## How to review
Find every path where user input reaches CSS (stylesheet, `<style>`, style attribute, theme config, CSS URL). The invariant: untrusted input must never become CSS that applies to a document containing secrets, and the rendering context must not load attacker-chosen external URLs. Check whether a strict CSP such as `style-src 'self'; img-src 'self'` blocks external fetches, whether attribute values holding secrets are ever in scope of injected rules, and whether the client honors proxy/network restrictions. For substring-only leaks, treat fragments as edges in a graph and enumerate routes to reconstruct the full value [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-smashing-the-token-limit.md).

## Variants seen
- Theme CSS with attribute selectors plus external `background-image` keylogging typed characters [E2](https://bugbountylibrary.com/r/blog%3Afletchto99-dev-2019-november-slack-vulnerability.md)
- Overlapping 3-6 char fragment selectors stitched into long tokens without recursive imports [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-smashing-the-token-limit.md)
- Inline style attributes using `if()`/`attr()`/`image-set()` to branch and exfiltrate without a stylesheet; requires modern CSS support and double-quoted comparisons [E3](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-inline-style-exfiltration.md)
- Client-side path traversal into a CSS URL plus an open redirect to load external CSS and exfiltrate DOM data [E4](https://bugbountylibrary.com/r/h1%3A1245165.md)

## Impact and severity
Led to keylogging of user input [E2](https://bugbountylibrary.com/r/blog%3Afletchto99-dev-2019-november-slack-vulnerability.md), recovery of tokens up to 640 chars [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-smashing-the-token-limit.md), and personal data exfiltration [E4](https://bugbountylibrary.com/r/h1%3A1245165.md). Severity rises when secrets are long-lived, when the client auto-fetches external URLs, and when no CSP limits outbound requests.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-smashing-the-token-limit.md
- E2: https://bugbountylibrary.com/r/blog%3Afletchto99-dev-2019-november-slack-vulnerability.md
- E3: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-inline-style-exfiltration.md
- E4: https://bugbountylibrary.com/r/h1%3A1245165.md