> It should also be noted, for some time similar attacks have been possible via html/css [1] As it happens, this particular attack doesn't work in gngr [0]. Th

> It should also be noted, for some time similar attacks have been possible via html/css [1] As it happens, this particular attack doesn't work in gngr [0]. The example uses an absolute positioned div to put extra text out of viewport, which is not picked up by gngr when selecting text. gngr also doesn't enable Javascript by default, so attacks such as that described in OP are not possible from random site visits. (I recommend uBlock / uMatrix for other browsers). However, the attack surface is really quite large here. CSS directives such as `opacity: 0.001` could be easily used to mask extra text. [0]: https://gngr.info/ and https://github.com/UprootLabs/gngr [1]: https://thejh.net/misc/website-terminal-copy-paste