In this talk we’ll discuss the impact of CSS (or stylesheet) injection attacks on web security. For that, we’ll first present some historical notes about CSS injections and related research. Then we’ll show and explain two working demos that leak HTML attributes and text nodes using only CSS (no JavaScript) from a vulnerable web page. Finally, we’ll show a recursion trick that allows these attacks to work w/o need of iframes or redirections, enabling them in isolated environments like Electron apps.