Smashing the token limit with overlapping fragments

Published: Monday, 5 October 2026 at 15:04 UTC Updated: Tuesday, 6 October 2026 at 08:33 UTC I'm delighted to introduce Alex, my fellow swigger who I've collaborated with in the past with tools like DOM Invader. He showed me that it's possible to exfiltrate larger tokens than demonstrated in my original "CSS: the bomb inside your inbox" post. Rather than bruteforcing large amounts of token characters he found that stitching together a large amount of smaller chunks can allow you to extract tokens hundreds of characters in length. Over to you Alex: How far can one stylesheet go? When Gareth previewed CSS: the bomb inside your inbox I was blown away. He could steal a login token with CSS alone, without having to recursively load another stylesheet for every character. Then I watched the browser wrestle with roughly 250 MB of CSS to recover a 12-character hex token. It worked. But such a large payload for 12 characters made me think there must be a better way. That evening I went back through his slides. Gareth had a fragment from the start, one from the end, and a way to find a matching fragment in the middle. Why stop at one piece in the middle? If I collected short pieces from everywhere in the link, perhaps I could join them until the whole token emerged. I pulled out my old theoretical computer science notes and started drawing the overlaps as a graph. I set myself two challenges. First, reproduce Gareth's 12-character result with the least CSS I could manage. Then keep his original CSS budget and see how long a token I could extract. For both I calculated a version that required a single correct candidate at least 99% of the time and a more realistic one which allowed for at most five candidates at least 90% of the time. The small sheets came out at 1.33 MB and 223 KB. With Gareth's full byte budget, the answers reached 210 characters with one guess and 640 characters with up to five. Here's how I got there. A token is a route through fragments Gareth’s CSS can tell us which short chunks appear in a link, but it can’t tell us where they appear. That turns out to be enough to start rebuilding the token. Take c2e16a1781ed. The first few chunks are c2e, 2e1, e16 and 16a. Each shares two characters with the next: c2e → 2e1 → e16 → 16a Read from left to right, they give us c2e16a. We can carry on in the same way until we reach the end of the token. This was the graph theory connection I saw in Gareth’s slides. Draw c2e as an arrow from c2 to 2e. The next …