Your CSS Is Not Harmless — It’s a Data Exfiltration Weapon
CSS can silently leak text from your web page without any JavaScript. Using advanced selectors like :has(), attackers can query text nodes and exfiltrate data through background images or font loads. This technique bypasses traditional protections and turns the browser’s rendering engine into a spy. Developers must treat CSS as an active security threat.