I did, before it was fixed[1]: > For many years the CSS :visited selector has been a vector for querying a user’s history. It’s not particularly dangerous by i

I did, before it was fixed[1]: > For many years the CSS :visited selector has been a vector for querying a user’s history. It’s not particularly dangerous by itself, but when it’s combined with getComputedStyle() in JavaScript it means that someone can walk through your history and figure out where you’ve been. And quickly – some tests show the ability to test 210,000 URLs per minute. At that rate, it’s possible to brute force a lot of your history or at least establish your identity through fingerprinting. Given that browsers often keep history for a long time it can reveal quite a bit about where you’ve been on the web. > At Mozilla we’re serious about protecting people’s privacy, so we’re going to fix this problem for our users. [1] https://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/ https://hacks.mozilla.org/2010/03/privacy-related-changes-co... Regardless of it being fixed (thanks for the update) it's still possible to do this via timing attacks. I wouldn't be surprised if the sieve that is a browser still allowed it in some other way.