The problem isn't Javascript in this case. You can trivially execute this attack with CSS by adding invisible spans that will be copied, but not rendered, and

The problem isn't Javascript in this case. You can trivially execute this attack with CSS by adding invisible spans that will be copied, but not rendered, and pseudo-elements that will be rendered but won't be copied. You can also trivially execute this attack by bundling a custom web font that contains invisible characters and swapped glyphs. I don't know what Apple's writing format is for Apple News, but AMP at least does not block this attack. It's not necessarily even a web thing -- PDFs are vulnerable to this attack, because they allow embedding custom fonts.