A CSS bomb is a crafted HTML and CSS payload that abuses how a browser or webmail client renders content. Instead of relying on JavaScript, it uses styles, selectors, layout quirks, and allowed markup to influence what the user sees or what the client processes. In a webmail setting, this can help an attacker hide or reshape interface elements, probe for sensitive state, or create side channels that leak information.
It matters because modern defenses often focus on script blocking, but CSS alone can still affect security boundaries. If a sanitizer allows too much structure or styling, attacker-controlled mail can interact with trusted UI features such as forms, autofill, or authenticated views. Defenders reduce the risk with strict allowlisting, strong rendering isolation, and testing against real browser behavior, not just expected sanitizer output.