The earliest I've seen this sort of idea (that CSS could be a source of security issues) was in: https://lcamtuf.blogspot.com/2011/12/notes-about-post-xss-world

The earliest I've seen this sort of idea (that CSS could be a source of security issues) was in: https://lcamtuf.blogspot.com/2011/12/notes-about-post-xss-world.html https://lcamtuf.blogspot.com/2011/12/notes-about-post-xss-wo... (Reflections on a post XSS world from 2011). Zalewski acknowledges earlier sources. EDIT: turns out CSS history sniffing is older than this