The attack could still work in some cases, and is as described in the linked post. Your webmail provider has a search box, and the content that is returned is

The attack could still work in some cases, and is as described in the linked post. Your webmail provider has a search box, and the content that is returned is styled with Roboto. If the search finds nothing, then Roboto isn't loaded. The attacker forces Rotobo out of the cache with a specially formatted fetch() request, then loads an iframe of the search. Then the attacker checks if Roboto is in the cache or not. This allows the attacker to essentially read your email inbox. https://sirdarckcat.blogspot.com/2019/03/http-cache-cross-site-leaks.html https://sirdarckcat.blogspot.com/2019/03/http-cache-cross-si...