It does seem mostly theoretical, but it also seems like a natural feature for a privacy-focused browser to exclude. Web browsers have a long history of “mostly

It does seem mostly theoretical, but it also seems like a natural feature for a privacy-focused browser to exclude. Web browsers have a long history of “mostly theoretical” becoming “effectively practical,” like when some new unrelated change invalidates an assumption underpinning the privacy guarantees of the original feature. In terms of this vector, I could imagine it leading to history enumeration when combined with CSS, similar to the classic “check the color of the link.” Or maybe some fingerprinting scripts could send signals to server-side traffic analysis heuristics by preloading a specific script based on which region of the screen is visible within the first second of loading the page. That’s all speculation of course, but clearly the feature increases privacy attack surface, by giving an external observer more paths for potentially reducing your possible anonymity sets.