There is a similar vulnerability with `mix-blend-mode` that enables a script to check whether a user has visited any given URL. It has existed since as early as

There is a similar vulnerability with `mix-blend-mode` that enables a script to check whether a user has visited any given URL. It has existed since as early as 2016 and is still a problem today in Chrome 67. See: https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-b... And here is a demo: http://lcamtuf.coredump.cx/whack/ http://lcamtuf.coredump.cx/whack/ It has limitations which make it slightly impractical to check against a large number of sites but it's still surprising to see this hasn't been fixed.