Stylemail: CSS alone could exfiltrate encrypted email plaintext

Stylemail demonstrates why “JavaScript is blocked” does not mean content rendering is safe. CISPA researchers built a scriptless attack in which standard CSS features measured successive characters of a decrypted message and encoded the result into requests for remote resources. In end-to-end demonstrations, a PGP-protected message’s complete plaintext could be reconstructed after one opening in a vulnerable client.

The cryptography was not broken. PGP correctly decrypted the message on the recipient’s device. The failure was placing trusted plaintext and an attacker-controlled stylesheet in the same rendering context while that context retained network access.

From ciphertext block to mixed-context email

The threat model assumes an attacker possesses an encrypted message — perhaps intercepted at a mail server or obtained from an earlier leak — but lacks the recipient’s private key. Without modifying the cryptographic block, the attacker wraps it in a new HTML email, adds CSS and sends the composite message back to its intended recipient.

When the client opens the message, it decrypts the block and renders it together with the external markup. The result is a mixed context: cryptography protects the secret text in transit, but after decryption it becomes subject to rules delivered by an untrusted sender.

The “Styled to Steal” paper identifies three key building blocks: container queries, lazy-loaded web fonts and contextual ligatures. A specially constructed ligature changes text width only when a tested prefix matches. A container query turns that geometric difference into a resource selection, and fetching an image or font reveals the result to the attacker’s server. CSS animations repeat the measurement character by character within one rendering pass.

Why an HTML sanitizer was insufficient

The chain needed no JavaScript, DOM events or conventional XSS. It relied on standards-compliant CSS, so DOMPurify’s default configuration did not necessarily remove it. A restrictive CSP script-src also does not automatically block fonts, images or layout measurements.

Researchers performed end-to-end demonstrations against Mozilla Thunderbird and KMail. They also identified insufficient isolation in Apple Mail with the GPGSuite plugin, although the plugin vendor’s response disputed practical exploitability in that configuration. Mozilla prepared mitigations, KDE acknowledged the issue and Meta expanded Code Verify’s threat model so integrity checks would include CSS.

The paper reports arbitrary text recovery at roughly two bytes per second, while values with a known format could be recognised much faster. This is not a file-download-rate channel, but it is sufficient for a key, password, token or short message.

Controls that actually interrupt the channel

1. Update Thunderbird, KMail, GPGSuite and relevant rendering components to current vendor releases.
2. Block remote email content by default, especially images, fonts and stylesheets. A “show images” button is a decision to open a network channel.
3. Render decrypted plaintext in a separate document where styles from the external MIME portion cannot apply.
4. Prefer a plain-text view for high-sensitivity material and disable HTML where the business process permits it.
5. In webmail, use a separate origin or a sandboxed iframe without network access for the decrypted fragment; DOM cleanup alone is not enough.
6. CSP should constrain font-src, img-src and style-src in the untrusted context, not only scripts.
7. At the proxy, monitor sequences of unique requests to a new host beginning after an email is opened, particularly for fonts and small images.
8. Test sanitizers for CSS exfiltration as well as XSS. Updating a library without a safe policy does not change the data model.

Facts and Breachroad analysis

The paper confirms the mechanism, tested clients, single rendering pass and absence of JavaScript. It does not establish that every webmail service or PGP client is vulnerable: specific CSS capabilities, a shared context and remote traffic are required. Treating the decrypted fragment as a separate security zone is Breachroad’s conclusion from the root cause, which is failed isolation.

AppSec and secure-coding training teaches teams to analyse data channels beyond JavaScript. A web application penetration test can cover HTML renderers, sanitisation, CSP and actual isolation in mail components.