Yes, this attack was demoed to work several years ago but has been patched as far as I know: https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and_the_%

Yes, this attack was demoed to work several years ago but has been patched as far as I know: https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and_the_%3Avisited_selector https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and... "The first change is that Gecko will lie to web applications under certain circumstances. In particular, getComputedStyle() and similar functions such as element.querySelector() always return values indicating that a user has never visited any of the links on a page."