CSS Bomb Attacks Turn Malicious Emails Into Password-Stealing Keyloggers

**CSS bomb** attacks leverage legitimate HTML/CSS features and sanitizer inconsistencies in major webmail clients to build real-time, JavaScript-free keyloggers and data exfiltration chains (demonstrated against Outlook, Gmail, Fastmail, ProtonMail, etc.), some of which have been patched while others reportedly remain unaddressed; recommended mitigations include sandboxed rendering, blocking risky selectors and disallowing auto-loading remote images.