This is really a timing side channel attack. Such side channel attacks have been known about for a long time but this one allowed you to leak information about

This is really a timing side channel attack. Such side channel attacks have been known about for a long time but this one allowed you to leak information about the color of a single pixel in your target page. I wouldn't say this is due to CSS being overpowered, it is much more due to the way that iframes can be configured to show a single pixel and the way that rendering times for your page are leaked into JavaScript. If your rendering is not done in constant time then the vulnerability occurs and CSS in this case allowed you to trigger non constant time rendering. The fix was to make the rendering constant time again.