Warning: this session will be held from 15:10 to 15:30 (shared slot)
CSS is usually treated as “just styling.” However, documented security research shows that it can be leveraged as an attack vector under certain conditions. From CSS injection and data exfiltration techniques using attribute selectors and external resource loading, to the historical :visited history leak and CSP bypass scenarios, CSS has a non-trivial security footprint.
In Drupal 11, these risks intersect with real-world features:
- Custom CSS capabilities (themes, contrib modules, layout tools)
- CKEditor 5 and text format permissions
- Asset libraries defined in *.libraries.yml
- Content Security Policy configuration
- Role and permission management
This session will break down realistic attack scenarios involving CSS in a Drupal environment, explain why they work, and outline concrete mitigation strategies. The goal is not fear, but clarity: understanding where the risks truly lie and how to address them responsibly.
