Stealing With Style: Using CSS to Exploit ProtonMail & Friends
summary
Finds critical XSS and RCE in ProtonMail, Skiff and Tutanota by abusing post-sanitization changes to DOMPurify and parser differences to turn SVG/style blocks into executable payloads; uses a CSS attribute selector leak with about 5,000 three‑character probes plus nested crossfade calls to reconstruct blob UUIDs and load attacker blobs, exploits iframe sandbox behaviors (Safari same‑origin quirk / popup escape) and a Cloudflare gadget to evade CSP, and achieves Windows RCE in the Electron Tutanota client via a dot‑exe filename bypass that writes and shell‑executes an attachment.
AI-written summary · about
chapters (8)
- 0:00Privacy-oriented webmailers intro
- 4:21Exploiting ProtonMail
- 19:59ProtonMail disclosure timeline
- 21:04Exploiting Skiff
- 26:48Skiff disclosure timeline
- 27:10Exploiting Tutanota Desktop
- 37:44Tutanota disclosure timeline
- 38:25Key learnings
