Yes and yes. You’ve already pointed out fingerprinting, but there are other attacks that can be done. See: - CSS keylogger, 2018: https://github.com/maxchehab

Yes and yes. You’ve already pointed out fingerprinting, but there are other attacks that can be done. See: - CSS keylogger, 2018: https://github.com/maxchehab/CSS-Keylogging https://github.com/maxchehab/CSS-Keylogging - OWASP cites CSS injection as a mechanism for XSS and data exfiltration: https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/05-Testing_for_CSS_Injection https://owasp.org/www-project-web-security-testing-guide/sta... Luckily we haven’t seen new classes of attacks here, but being concerned about attack surface of any browser technology is valid and reasonable.