These only allow attacks where the desired data exists in the html of the page that the browser downloads (or can be forced there). You can also do font-based a

These only allow attacks where the desired data exists in the html of the page that the browser downloads (or can be forced there). You can also do font-based attacks that will steal data that is entered dynamically. http://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode-range.html http://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode...