CSS exfiltration is an attack technique that abuses style rules and normal browser behavior to leak information from a rendered page. Instead of running script, an attacker uses CSS selectors, layout effects, and resource-loading features to make the browser reveal whether certain text, attributes, or states are present. Those small signals can be turned into requests to an attacker-controlled server, exposing secrets one bit at a time.
This matters because many web apps render untrusted HTML inside authenticated sessions. If sanitization allows enough styling power, CSS can become a covert channel for passwords, tokens, account data, or other sensitive content. In real attacks, it often appears as blind exfiltration: the victim never sees the leak, but the browser quietly requests different assets depending on the page content. Defenses include strict HTML and CSS sanitization, Content Security Policy, blocking external resources, isolating untrusted rendering, and treating email or user-generated content as hostile by default.