Worth noting that this general category of render-timing-based pixel-reading has been around for a while. e.g. https://www.contextis.com/media/downloads/Pixel_

Worth noting that this general category of render-timing-based pixel-reading has been around for a while. e.g. https://www.contextis.com/media/downloads/Pixel_Perfect_Timing_Attacks_with_HTML5_Whitepaper.pdf https://www.contextis.com/media/downloads/Pixel_Perfect_Timi... is from 2013, uses svg instead, and I could swear I've seen a CSS one from a few years ago. I really suspect there's only one fix, and it seems reasonable to me: don't allow sites to place content over iframes, period. Allowing it opens all kinds of exploits like this and various flavors of clickjacking, all basically un-preventable since there's no limit to the techniques possible.