I haven’t delved, but this shouldn’t be a fingerprinting vector (except for the one bit of whether it’s implemented), as all browsers will be implementing the s

I haven’t delved, but this shouldn’t be a fingerprinting vector (except for the one bit of whether it’s implemented), as all browsers will be implementing the same thing, like with HTML parsing. As for the other cases you describe, I’d say the problem isn’t so much that fingerprinting vectors exist as it is that ad providers allow arbitrary unsandboxed code execution, which is an obviously-terrible idea that never should have happened.