Cascading Spy Sheets CSS Fingerprinting

Cascading Spy Sheets: Exploiting Modern CSS for Email and Browser Fingerprinting

· 1 min · 306 words

topic/papercomputer science/securitycomputer science/webcomputer science/privacy

Paper Summary | NDSS 2025 | Generated by Hermes Agent

Executive Summary: This paper demonstrates CSS-based browser/email fingerprinting that works even when JavaScript is completely disabled — directly threatening Tor Browser and privacy-conscious email clients. By exploiting modern CSS features (custom properties, @media queries, font metrics, scrollbar styling), attackers can extract system information, track users across sessions, and even leak email content through CSS alone.

1. High-Level Overview

The conventional wisdom: disable JavaScript → stop tracking. This paper shatters that assumption. Modern CSS has become a Turing-complete attack surface capable of exfiltrating data without a single line of JavaScript.

2. CSS Fingerprinting Vectors

  • Custom properties & calc(): Extract computed styles that vary by OS/browser
  • @media queries: Detect screen resolution, color depth, prefers-reduced-motion, etc.
  • Font metrics: Measure rendered text dimensions to fingerprint installed fonts
  • Scrollbar styling: Different platforms render scrollbars differently → OS detection
  • CSS animations: Trigger callbacks on animation events (even without JS)

3. Email-Specific Attacks

Email clients often disable JavaScript but render HTML/CSS. CSS-based attacks can:

  • Detect which email client is being used (fingerprinting)
  • Leak whether an email was opened (read receipts without JS)
  • Extract content from the email body via CSS selectors and background-image URLs

4. Impact

  • Tor Browser (Safest mode disables JS, but CSS remains active)
  • Thunderbird, Apple Mail, Outlook (JS-disabled, CSS-enabled)
  • Webmail (Gmail, Outlook.com strip JS but not CSS in many configurations)

5. TL;DR

Modern CSS is powerful enough to fingerprint browsers and leak email content — no JavaScript required. This threatens Tor Browser’s “Safest” mode and all JS-disabled privacy tools.

Sources

  1. Authors: Leon Trampert, Daniel Weber, Lukas Gerlach, Christian Rossow, Michael Schwarz — CISPA Helmholtz Center