You open an email from your favorite newsletter. You don’t click anything. You don’t download any attachments. You just read. Yet, in the seconds it takes you to scan the first paragraph, someone just exfiltrated your data. How? Through the exact same code that made the email look pretty.
We have spent decades training people to fear malicious attachments and suspicious URLs. We check link previews. We use secure sandboxes. But we turn a completely blind eye to email CSS—Cascading Style Sheets, the innocent language that makes emails colorful and formatted. We think it’s just paint. It’s actually an open door.
We’ve spent decades training people to fear links, only to completely ignore the fact that the code making the email look good is watching us.
Email clients are weird beasts. To display richly styled emails without running JavaScript—which is disabled across major clients for security reasons—they allow CSS to do some surprisingly powerful things. An attacker doesn’t need a malicious script. They just need a clever @media query, a background-image tag, or a font-loading trick. When you open the email, the CSS checks your screen size, your operating system, and even how far you’ve scrolled. Then, it silently pings that data back to the attacker’s server.
This isn’t a theoretical threat. It is happening right now. Hackers and corporate trackers are using CSS to trigger external requests, bypassing standard privacy filters. They know when you read the email, what device you’re on, and whether you forwarded it to a colleague. They are turning your most trusted communication tool into a 24/7 surveillance device.
CSS is no longer just a design language; it’s a spy disguised as web design.
This is where perception and reality violently collide. Developers treat CSS as the presentation layer—pure aesthetics. Security teams treat it as a harmless nuisance. But by exploiting the quirks of email client rendering engines and network behaviors, attackers have turned a passive language into an active, weaponized threat. You don’t need to click a link to get hacked; you just need to view an email.
When simply opening an email counts as an attack, the entire premise of our security education is a scam.
Your inbox is your most trusted digital space. You use it for banking, personal communications, and work. But if the very tools designed to make that space usable can be weaponized against you, trust becomes vulnerability. The next time you open a beautifully formatted email, remember: beauty has a price, and that price might just be your privacy.
FAQ
Q: Is CSS really that dangerous? Isn't it just for styling?
A: In a browser, maybe. But in the broken rendering engines of email clients, CSS can trigger network requests, check screen sizes, and track your behavior. It doesn't need JavaScript to be an active threat.
Q: What's the practical implication? How do I protect myself?
A: The implication is your reading habits and device info are being silently stolen. To protect yourself, disable remote images by default, use privacy-focused email clients, and block external resources from loading.
Q: What's the contrarian take?
A: Email providers should just disable all CSS entirely. If email clients can't handle basic styling securely, the aesthetic benefits aren't worth the security trade-off. Plain text emails are the only truly secure emails.