It seems that the Scratch Team have patched the CSS glitch which has allowed users to customize their Scratch project pages using CSS code in vector SVG costumes. Here are some FAQs:

- When did the glitch get patched?
-> Probably around August 6th, so just a couple days ago

- Why did it get patched?
-> Probably because people might use css to do something nasty to your project page (e.g. change the Scratch logo into something inappropriate), or put malware into your computer (thanks to @TheCanadianEngineer for pointing the malware thing out)

- Will it ever come back?
-> Probably not, since you can't stop people from using it the wrong way.

- Will there be an option to customize project pages in the future?
-> I don't know, but hopefully we can do that to some extent to replace the inconsistent and patched CSS method.

You can talk about the glitch on this topic!

It can't put malware on your computer

gem1001 wrote:

It can't put malware on your computer

Browsers are way more vulnerable than you think.
Also i think id rather not have my whole screen filled with images of… well you know what.

localrulebreaker wrote:

gem1001 wrote:

It can't put malware on your computer

Browsers are way more vulnerable than you think.

All it can do is CSS
If there was an easy way to put malware on someone's computer using only CSS, every sketchy website would be doing it by now

SmileHedgehog wrote:

- Why did it get patched?
-> Probably because people might use css to […] put malware into your computer (thanks to @TheCanadianEngineer for pointing the malware thing out)

I don't think it's possible to do that. I think you confused it with the XSS Glitch, which was another bug related to SVGs, but it injected JavaScript and it was fixed a few months ago (except in those versions of the offline editor which are older)

gem1001 wrote:

-snip-

All it can do is CSS
If there was an easy way to put malware on someone's computer using only CSS, every sketchy website would be doing it by now

CVE-2026-2441

localrulebreaker wrote:

gem1001 wrote:

-snip-

All it can do is CSS
If there was an easy way to put malware on someone's computer using only CSS, every sketchy website would be doing it by now

CVE-2026-2441

Interesting… but it still uses Javascript

GUYS HELP I WENT INTO A CSS INJECTED PROJECT AND NOW I CANT EDIT COSTUMES WHAT DO…..;

set [ help needed] to [1e+303]

SojoTheHedgeh104 wrote:

GUYS HELP I WENT INTO A CSS INJECTED PROJECT AND NOW I CANT EDIT COSTUMES WHAT DO…..;

set [ help needed] to [1e+303]

wdym? the glitch has been fixed anyway so I don't see how it could affect costume editing in other projects since you can't've gotten hacked

redspacecat wrote:

wdym? the glitch has been fixed anyway so I don't see how it could affect costume editing in other projects since you can't've gotten hacked

basically i went into a project that previously included css injection and for some reason i couldnt see costumes in the costume editor anymore and now its innaccessable. i think there might be some invisible code still lying around but im not for sure

SojoTheHedgeh104 wrote:

redspacecat wrote:

wdym? the glitch has been fixed anyway so I don't see how it could affect costume editing in other projects since you can't've gotten hacked

basically i went into a project that previously included css injection and for some reason i couldnt see costumes in the costume editor anymore and now its innaccessable. i think there might be some invisible code still lying around but im not for sure

The glitch has been patched, so all projects with CSS as a gimmick don't work anymore, even one of my games which just had a custom logo and proj3ct style lol. The problem you're experiencing is probably not anything to do with css.

gem1001 wrote:

localrulebreaker wrote:

gem1001 wrote:

-snip-

All it can do is CSS
If there was an easy way to put malware on someone's computer using only CSS, every sketchy website would be doing it by now

CVE-2026-2441

Interesting… but it still uses Javascript

No. Where did you read that it used JavaScript?

localrulebreaker wrote:

gem1001 wrote:

localrulebreaker wrote:

gem1001 wrote:

-snip-

All it can do is CSS
If there was an easy way to put malware on someone's computer using only CSS, every sketchy website would be doing it by now

CVE-2026-2441

Interesting… but it still uses Javascript

No. Where did you read that it used JavaScript?

https://issues.chromium.org/issues/483569511
https://issues.chromium.org/action/issues/483569511/attachments/73328851?download=false
Just adding the 300 properties generated by the JS from the start does not result in STATUS_ACCESS_VIOLATION, unlike with the JS
My browser / operating system: Windows NT 10.0, Chrome 136.0.0.0, No Flash version detected

localrulebreaker wrote:

well you know what.

I dont know what, what is it

scratchy_boy106 wrote:

localrulebreaker wrote:

well you know what.

I dont know what, what is it

Probably 18+ content or something