CSS-Keylogging

Yes and yes. You’ve already pointed out fingerprinting, but there are other attacks that can be done. See: - CSS keylogger, 2018: https://github.com/maxchehab/CSS-Keylogging - OWASP cites CSS injection as a mechanism for XSS and data exfiltration: https://owasp.org/www-project-web-security-testing-guide/sta... Luckily we haven’t seen new classes of attacks here, but being concerned about attack surface of any browser technology is valid and reasonable.

CSS indeed can send the content of an input field [0], but it’s way too much of a hassle to be used in the wild. [0]: https://github.com/maxchehab/CSS-Keylogging

DomPurify by default allows style tags ( https://github.com/cure53/DOMPurify/blob/master/src/tags.js#... ) which can be used for tracking visits and some types of password extraction from certain types of frameworks (see https://www.mike-gualtieri.com/posts/stealing-data-with-css-... and https://github.com/maxchehab/CSS-Keylogging ). Also regarding these types of mitigations see https://www.youtube.com/watch?v=lG7U3fuNw3A which explains how some good mitigations might not catch all edge cases. I don't think there is a golden rule for this stuff besides having a very strict CSP that only allows same-site resources and no eval/inline with reporting to see when someone has tried to do something bad.

False: it is possible with just CSS [1][2] to track screen resolution, browser engine, fonts, mouse movements and inputs. [1] https://github.com/jbtronics/CrookedStyleSheets [2] https://github.com/maxchehab/CSS-Keylogging

I didn't know you could not check if a link is blue or purple with javascript. I assume you can't do it through standard means. What about this css hack? https://github.com/maxchehab/CSS-Keylogging Wouldn't using a selector like a:visited { background-image: url-to-tracking-image }? You can apply this with JS and check the href, although you can do that with CSS as well.