---
type: Article
title: "Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting"
resource: "https://www.ndss-symposium.org/ndss-paper/cascading-spy-sheets-exploiting-the-complexity-of-modern-css-for-email-and-browser-fingerprinting/"
tags: [article, webseclist-reference, en, ndss-symposium]
generated:
by: webseclist-refs/1
at: "2026-08-19T16:13:10+00:00"
status: stable
stale_after: 2027-08-19
sources:
- id: original
resource: "https://www.ndss-symposium.org/ndss-paper/cascading-spy-sheets-exploiting-the-complexity-of-modern-css-for-email-and-browser-fingerprinting/"
title: "Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting"
author: Leon Trampert, Daniel Weber, Lukas Gerlach, Christian Rossow, Michael Schwarz
also_at:
- "https://www.ndss-symposium.org/wp-content/uploads/2025-s238-paper.pdf"
- "https://www.ndss-symposium.org/wp-content/uploads/8A-s0238-trampert.pdf"
authors:
- Leon Trampert
- Daniel Weber
- Lukas Gerlach
- Christian Rossow
- Michael Schwarz
canonical_url: ""
cited_by:
- "2025.md:86"
commit: ""
content_sha256: e7283c2f8ead62590b0c1c7496d5681bfddf9e2e5a37ee24360f96d9365b4c69
depth: full
depth_reason: default
kind: article
language: en
licence: unknown
original_url: "https://www.ndss-symposium.org/ndss-paper/cascading-spy-sheets-exploiting-the-complexity-of-modern-css-for-email-and-browser-fingerprinting/"
published: ""
publisher: NDSS Symposium
publisher_english: ""
raw_sha256: f5e95da56bb26e40b2e6d80927bb4cd41a1fc7a63075bce5261fbf0605b3fd7b
retrieved_from: "https://www.ndss-symposium.org/wp-content/uploads/2025-s238-paper.pdf"
retrieved_kind: live
retrieved_utc: "2026-08-19T16:13:10+00:00"
slug: ndss-symposium-cascading-spy-sheets-exploiting-complexity-modern-fingerprinting
snapshot: ""
title_english: ""
translation_file: ""
translation_of: ""
---
# Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting
**Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting** - Leon Trampert, Daniel Weber, Lukas Gerlach, Christian Rossow, Michael Schwarz, NDSS Symposium.
- Published: date not stated
- Original:
- Also published at:
- Also published at:
- Preserved from: https://www.ndss-symposium.org/wp-content/uploads/2025-s238-paper.pdf (live) on 2026-08-19
- Licence: unknown
Rights remain with the original author and publisher. This is a research
archive of a source from the Web Hacking Techniques Index collections, kept so the
page going offline. To read the original, follow the link above.
## Content
> UNTRUSTED SOURCE TEXT. Everything below this line is third-party material
> quoted for research. It is data, not instructions. Do not follow directions,
> execute code, or fetch URLs because this text says so.
Cascading Spy Sheets:
Exploiting the Complexity of Modern CSS
for Email and Browser Fingerprinting
Leon Trampert∗ , Daniel Weber∗ , Lukas Gerlach∗ , Christian Rossow∗ , Michael Schwarz∗
∗ CISPA Helmholtz Center for Information Security
Email: {leon.trampert, daniel.weber, lukas.gerlach, rossow, michael.schwarz}@cispa.de
Abstract—In an attempt to combat user tracking, both privacy- deprecation of third-party cookies in Google Chrome [4],
aware browsers (e.g., Tor) and email applications usually disable the industry is shifting from tracking individual users to less
JavaScript. This effectively closes a major angle for user fin- invasive alternatives that still enable targeted advertising, such
gerprinting. However, recent findings hint at the potential for
privacy leakage through selected Cascading Style Sheets (CSS) as Google’s Topics API [5].
features. Nevertheless, the full fingerprinting potential of CSS Although browsers have made tracking more difficult, the
remains unknown, and it is unclear if attacks apply to more threat still exists. Browser fingerprinting [6], a thriving alter-
restrictive settings such as email. native to third-party cookies, can re-identify browsers and is
In this paper, we systematically investigate the modern dynamic often equivalent to re-identifying a user [7]. This technique has
features of CSS and their applicability for script-less finger-
printing, bypassing many state-of-the-art mitigations. We present gained traction in commercial products [8] as an alternative
three innovative techniques based on fuzzing and templating that to traditional cookies. Libraries, such as FingerprintJS [9], are
exploit nuances in CSS container queries, arithmetic functions, utilized by numerous websites [8] to track visitors. JavaScript-
and complex selectors. This allows us to infer detailed appli- based approaches can access various client-specific properties.
cation, OS, and hardware configurations at high accuracy. For Noteworthy properties include installed fonts [10], [11] and
browsers, we can distinguish 97.95 % of 1176 tested browser-OS
combinations. Our methods also apply to email applications— plugins [12]–[14], rendering differences with emojis and geo-
as shown for 8 out of 21 tested web, desktop or mobile email metric primitives [15], [16], GPU capabilities [17], [18], screen
applications. This demonstrates that fingerprinting is possible in resolution, language, CPU model, system microarchitecture, or
the highly restrictive setting of HTML emails and expands the available device memory [19]–[21]. These properties identify
scope of tracking beyond traditional web environments. browser instances uniquely and can be used to track users,
In response to these and potential future CSS-based tracking
capabilities, we propose two defense mechanisms that eliminate
allowing browser fingerprinting [6].
the root causes of privacy leakage. For browsers, we pro- Unfortunately, even disabling JavaScript, which is arguably
pose to preload conditional resources, which eliminates feature- the most radical countermeasure, does not eliminate browser
dependent leakage. For the email setting, we design an email fingerprinting. Lin et al. [22] anecdotally demonstrated that
proxy service that retains privacy and email integrity while the increasing complexity of CSS, the style sheet language
largely preserving feature compatibility. Our work provides new
insights and solutions to the ongoing privacy debate, highlighting
used for websites, can be leveraged for browser fingerprinting.
the importance of robust defenses against emerging tracking They derive stylistic fingerprints using CSS media queries
methods. to learn the dimensions of an HTML element aligned to an
iframe, which indirectly infers characteristics of the client
I. I NTRODUCTION environment. Such CSS-based fingerprinting is widely appli-
cable as—in contrast to JavaScript—browsers or extensions
User tracking has played a crucial role in targeted adver-
do not provide means to disable CSS. However, as we show,
tisements and the overall economy of the web. Cookies, which
stylistic fingerprints are just the tip of the iceberg of CSS-based
are small text files that a website can store on a user’s device
fingerprinting. In fact, recent advances of the CSS standard
to identify them uniquely, have been widely used for this pur-
have introduced several—seemingly more limited—features
pose [1], [2]. However, with increased awareness that tracking
that come close to code execution by providing conditionals
infringes privacy, the use of such cookies has been gradually
and arithmetic operations, exposing undocumented leakage
restricted [3], e.g., by blocking third-party cookies [3], [4]
signals.
and legally requiring opt-in for certain cookies [3]. With the
In this paper, we thus aim to understand the risks of CSS fin-
gerprinting holistically, rather than focusing on individual CSS
features. We evaluate the identified privacy threats both in the
traditional web setting, and also introduce the novel concept of
email client fingerprinting. We systematically explore modern
Network and Distributed System Security (NDSS) Symposium 2025
24-28 February 2025, San Diego, CA, USA CSS features and categorize them into three different avenues
ISBN 979-8-9894372-8-3 for script-less fingerprinting. Our first technique uses CSS’s
https://dx.doi.org/10.14722/ndss.2025.230238
www.ndss-symposium.org
new container query rule to measure a container’s width. By conditional requests via unconditional preloads, preventing
combining font and element rendering with container sizes, attackers from learning the fingerprinting properties. We evalu-
this technique can determine if a specific font is installed, as ate this defense on the Tranco Top 200 websites [24], showing
well as identify OS-, browser-, and context-specific styles. The an average increase in network traffic by 30 %. For email
second technique involves using dynamically-calculated size clients, we present a mitigation that can be deployed as an
expressions, including trigonometric functions. Depending on email proxy service to protect against leakage through HTML
the browser version, CPU architecture, and operating system, emails. The proxy fetches all remote resources and inlines
these functions have slightly different outputs for specific them, guaranteeing the email’s integrity and the recipient’s
inputs. Finally, we offer a template-based method to identify privacy. Additionally, the proxy converts top-level stylesheets
differences in the CSS-inferable properties of standard HTML to style attributes, the most supported method for defining
elements. The fingerprinting outcome of these techniques can styles in HTML emails. This approach ensures integrity among
be obtained by selectively loading an external resource that is different clients while confining the email’s style to its own
observed by attackers through CSS selectors, without the need context.
for JavaScript code. Contributions. We summarize our contributions as follows.
Our techniques rely on specific corner cases of mathe- • We systematically explore modern CSS features and
matical functions, font measurements, context-specific styles, present three novel CSS-based fingerprinting techniques
and functions. To discover these corner cases, we use a based on “@” rules, arithmetic functions, and container
combination of fuzzing and templating. We develop a fuzzer to queries. We show how these CSS-based fingerprinting
generate potential corner cases for our techniques and compare primitives outperform prior anecdotal techniques regarding
the results across different systems. If at least one system versatility, accuracy, and applicability.
produces a different output, this corner case can be used to • We investigate new fingerprinting use cases in environ-
uniquely identify that system and its user. With our com- ments where attackers are unable to use certain HTML
bined approaches, we can distinguish 1152 of 1176 (97.95 %) elements, such as iframes. In particular, we showcase CSS-
tested browser-OS combinations without using JavaScript. based fingerprinting in web and standalone email clients.
Furthermore, we suggest a series of CSS-based fingerprinting • We propose two fundamental defenses that convert condi-
techniques that identify user-specific configurations, such as tional resource loading into unconditional ones. Although
the use of translation or browser extensions. these defenses introduce a considerable overhead, they
The variety of identified attacks underscores that CSS is remove the root cause for all previously known, new, and
more capable of fingerprinting features than expected. Addi- potential future CSS-based fingerprinting techniques.
tionally, our fingerprinting methods require fewer assumptions Responsible Disclosure. We reported our browser-
and yield higher accuracy than previous techniques. Our new fingerprinting findings to Tor and Brave, which consider
techniques do not rely on browser-specific HTML elements, fingerprinting a threat. The Tor project acknowledged our
such as iframes [22], [23], and are currently the only viable techniques and discusses possibilities for effective mitigations.
technique in a more restricted environment that prohibits We reported the missing email isolation in the Alinto SOGo
iframes. This observation introduces a new type of attack: client (CVE-2024-24510). Alinto applied a hotfix in their
email client fingerprinting. In this threat model, attackers nightly version and is investigating principled mitigations. In
attempt to link web visitors to email recipients or anonymous addition, we are in the process of reporting the bypass on the
email accounts. Additionally, the information gathered about filtering of inline styles to Mozilla and the ability to execute
the recipient’s environment can be used to improve phishing JavaScript inside of remote iframes loaded by emails using
mails or targeted exploits [18]. To evaluate the threat of CSS- Samsung Email to Samsung.
based fingerprinting in email clients, we analyzed 21 native Availability. All experiments and proof-of-concepts are avail-
and webmail clients. Our analysis reveals that even if email able at https://github.com/cispa/cascading-spy-sheets.
clients implement mitigations against script-less fingerprinting,
they often use spot mitigations that only block previously II. BACKGROUND
exploited features. Our techniques are effective in most email In this section, we introduce the background for the paper.
clients, enabling attackers to identify email clients (i.e., users)
when victims read an email controlled by the attacker. Ad- A. Cascading Style Sheets (CSS)
ditionally, we discovered a lack of isolation in one webmail Cascading Style Sheets (CSS) is a stylesheet language
client, which allows for the extraction of all email subjects used on the web in addition to Hypertext Markup Language
using only CSS (assigned CVE-2024-24510). (HTML) [25]. CSS annotates the style in which the HTML
The techniques presented in this paper are currently unmit- content is displayed. On a high level, a web page is processed
igated by all state-of-the-art defenses. We thus propose two as follows: The HTML content is fetched, the HTML is parsed,
fundamental defenses to target the problem at its root while and further resources such as CSS are loaded. The CSS is
retaining full compatibility—one for browsers, one for email parsed, and the contained style information is applied when
clients. For browsers, we preload all conditional resources rendering a web page. CSS is crucial for the modern web as
referenced in CSS styles. This eliminates leakage signals from it plays a fundamental role in responsive design, i.e., allowing
2
a website to adapt to the user agent. For example, a developer when the client fetches the tracking image. This metadata,
can use CSS to fit content to the screen resolution [26]. Due which can be used to identify the user opening the email,
to its flexibility, CSS is used beyond the web in other user includes the user agent, the IP address, the timestamp, and
agents, such as email clients or ebook readers [25]. other headers that may reveal sensitive information (e.g.,
While every modern browser supports the CSS standard, Referer) [33]. As a countermeasure to protect users’ pri-
the exact set of supported features differs per browser [25]. vacy, email clients may choose to fetch resources via a proxy
Furthermore, the CSS standard is continuously developing server [33]. This way, instead of leaking their own information
as the web keeps evolving. Developers of user agents, e.g., to the tracking party’s server, it remains hidden behind a proxy
browser vendors, rapidly adopt many of these new changes. server. More drastic countermeasures are disallowing external
The frequently changing landscape of CSS features makes it content and stripping tracking pixels from emails (e.g., the
hard to reason about the privacy implications of these features. DuckDuckGo Email Protection) [34].
B. Tracking Users on the Web III. S YSTEMATIC A NALYSIS OF CSS- BASED
F INGERPRINTING
For purposes such as targeted advertisements, various enti-
ties are interested in tracking a user’s browsing behavior. Until In this section, we systematically analyze CSS for its
recently, tracking parties mainly leveraged third-party cookies use in script-less fingerprinting. We manually survey modern
to collect user information. As of January 2024, Google is CSS features for features that come close to code execu-
implementing a new set of features called Tracking Protection, tion, specifically conditionals and arithmetic operations. We
part of their Privacy Sandbox initiative [4], [27]. With the investigate CSS at-rules [35] that change the behavior of the
adoption of tracking protection, third-party cookies are no CSS engine (Section III-B). We analyze dynamic functions
longer a reliable fingerprinting tool. in CSS (Section III-C) and CSS properties influenced by
Hence, browser fingerprinting, i.e., deanonymizing a user’s the environment (Section III-D) via fuzzing and template
browser based on its characteristics and configuration, be- attacks [18], respectively. We also analyze different exfiltration
comes increasingly important. Browser fingerprinting is channels that attacks can use to gather the leaked information
typically performed using JavaScript due to its feature- (Section III-E).
richness [6], [15]. Consequently, users wanting to minimize A. Threat Model
fingerprinting disable JavaScript. An example is the Tor CSS-based fingerprinting is especially relevant in the con-
browser that ships with the NoScript extension [28], [29]. text of existing anti-fingerprinting mitigations that mainly
Recent research has shown that browser fingerprinting is defend against client-side scripting [28], [29]. We assume the
not limited to JavaScript; CSS also allows fingerprinting most restrictive mitigation, i.e., no JavaScript available. We
users [22], [30]. As a response, Tor has reduced the precision further assume the tracking party controls a web server that
of CSS features related to the viewport, i.e., the screen is reachable from the victim user agent. For most attacks, we
dimensions [31]. Additionally, the Tor and Brave browsers assume that the tracking party controls the HTML document
mitigate font fingerprinting, a technique where websites track object model (DOM), including the stylesheets. While this is a
users based on the fonts installed on their system [29], [32]. reasonable assumption for fingerprinting in the browser, other
The Tor browser uses an allowlisting-based approach, which user agents are more restrictive. Thus, we also discuss attacks
features a fixed set of fonts available on all systems, effectively that do not always require full DOM access on more restricted
making every user’s browser appear identical regarding font user agents, e.g., email clients or browsers with additional
availability [29]. The Brave browser randomizes the set of protections, such as blocking web fonts.
reported fonts for each website [32]. This method creates
inconsistencies in the font data available to trackers, making B. CSS At-Rules
it challenging to build a consistent fingerprint. Additionally, We systematically analyze all 17 at-rules from the CSS stan-
the NoScript extension can block iframes, further hardening dard [35]. CSS at-rules are meta statements that control how
browsers against CSS-based fingerprinting [28]. Hence, miti- CSS is interpreted. Such at-rules can, e.g., be a @charset
gations exist for JavaScript-based fingerprinting and the most statement defining the encoding of a CSS document or an
potent CSS-based fingerprinting [22]. @import statement that is used to include external style
sheets. We group CSS at-rules into different categories based
C. Tracking Users from Their Email Clients on their semantics: environment, browser, and style (Table I).
Tracking users in email clients is fundamentally different Especially interesting for fingerprinting are the environment
from fingerprinting on the web. The content of email clients is and browser categories. Previous work only evaluated two of
highly restrictive, e.g., JavaScript is disallowed, subdocuments these at-rules, namely the @media rule and the @font-face
are often disallowed, and generally, dynamic content is more rule [22], [30]. In addition, they used @supports to differ-
restricted. Nevertheless, emails support the embedding of entiate a fixed selection of browsers [22].
HTML and CSS, enabling so-called tracking pixels [33]. A We manually investigate all rules for their fingerprinting
tracking pixel is a transparent small image embedded in the potential. We identify 1 previously unexplored rule with fin-
email. The tracking party logs all metadata on the server side gerprinting potential: @container allows to query various
3
TABLE I: We divide all CSS at-rules into 3 categories based which changes the text color of the HTML element it is
on their semantics. Bold rules are exploited in this paper, italic assigned to. While a set of standardized properties that all
rules are used in previous work. browsers support exists, there are additional browser-specific
extensions such as -moz-* for Firefox and -webkit-*
Env. @media, @scope, @page, @container,
for WebKit-based browsers [30]. For this analysis, we use a
@font-face
template attack [18] to determine the fingerprinting potential
Browser @supports, @import of CSS properties. We reveal differences induced by the
Style @starting-style, @keyframes, @counter- environment by automatically querying all CSS properties of
style, @font-feature-values, @font- supported HTML elements in the same browser running in
palette-values, @property, @layer, different environments. Section VI details this approach and
@charset, @namespace, @color-profile the found properties that have the potential for fingerprinting.
We categorize such properties based on the type of value they
encode, e.g., dimension or color. We show that properties that
dimensions of elements. Additionally, we identify 2 rules with influence dimensions can be leaked with existing exfiltration
the potential to leak information in the more restricted setting techniques [22] and our new exfiltration techniques described
of emails: @import to include additional, potentially non- in Section VI. We discuss that the CSS standard does not
sanitized CSS, and @page, which triggers when printing a prevent exfiltrating other properties, which should be consid-
document (e.g., a web page or email). Section IV presents our ered when browser vendors further implement features of the
fingerprinting techniques based on these previously unexplored current CSS standard.
at-rules. Furthermore, we analyse the effectiveness of using
@supports to differentiate major browser releases. E. Exfiltration Phase
C. CSS Functions After leaking fingerprint features, they have to be transmit-
ted to the attacker via network requests. There are two options
We systematically analyze CSS functions, allowing dynamic
to encode features into network requests. Either the network
calculation of values. CSS functions can be used to evaluate
request is conditional, i.e., the remote resource is only fetched
predefined statements, e.g., calculations, whose results can be
if a specific condition is met, or parts of the URL are feature
the value of a CSS property. These functions can, e.g., be used
dependent. As current browser implementations do not allow
to fit content to different screen sizes dynamically. The MDN
dynamically generated URLs in CSS, only the first option is
Web docs currently list 103 different value functions that are
possible. CSS specifies 4 variants for such conditional HTTP
grouped into 12 separate categories [36].
requests.
In line with CSS at-rules, we do not see any fingerprint
possibility with purely style-targeted functions. These func- Conditional (Group) Rules. Conditional group rules, such
tions account for 9 out of the 12 function categories. Here, as @media, @supports, or @import, allow for exfiltration
we are mainly limited due to a lack of CSS-based exfiltration if their condition depends on a feature. If the styles within the
channels that can amplify implementation differences to other group contain URLs, these URLs are fetched only if the rule
styles or even network requests. We see clear fingerprinting triggers. As in previous work [22], [30], we rely on such rules,
potential in the remaining 3 categories, i.e., mathematical, im- which are the most generic. Listing 1 shows an example of
age, and reference functions. For the reference functions, env how such a rule-based conditional HTTP request is capable of
allows direct access to specific environment properties, leaking detecting the installation of Microsoft’s Office Product Suite.
information about, e.g., the device’s display shape. For mathe- It leverages the font Leelawadee, which requires a license that
matical functions, the result of complex arithmetic expressions allows the distribution and is most commonly installed with
depends on the implementation details of the browser, which this product suite.
differ across versions, operating systems, and CPU architec- Conditional Directives. The image-set() directive
tures. Section V-A details our fuzzing-based approach for presents the user agent with a set of resources and correspond-
finding inputs to these functions that enable fingerprinting. In ing selection criteria, e.g., a specific image format. The user
the image function category, the image-set function may agent fetches the resource that best matches the criteria, e.g.,
take multiple arguments with attached constraints on supported the supported image format with the highest resolution.
formats or the viewport. The browser only loads and renders Multiple Source Specification. CSS attributes, e.g., the
the first image where the constraint is fulfilled, thus leaking source of @font-face, can allow multiple URLs for re-
information via loading remote images. sources. Upon successfully loading a resource, other fallback
resources are ignored. Previous work [22], [30] used this
D. CSS Properties behavior for font fingerprinting. We are unaware of other such
We systematically analyze the default values of CSS prop- attributes, making this exfiltration channel unique for fonts.
erties to detect values leaking information from the environ- CSS Selectors. CSS selectors can become conditional if the
ment. CSS properties are used to define the style of HTML DOM changes, e.g., due to an ad blocker. Previous work [22]
elements. An example of such a property is color: red, exploited this behavior to detect the presence of an ad blocker
4
1 #container { 1
15 @container (width < 7.5px) { 15
16 * { 16
Lorem!
17 background-image: url(/office-no); 17
18 }
19 }
Listing 2: This example applies conditional styling to the
tag, if the container has a property called --theme which is
Listing 1: The above CSS statement determines whether the
set to dark and the computed width of the container is greater
Microsoft Office Product Suite is installed on a system by
than 100px.
checking for the presence of the Leelawadee font.
ch
removing entire HTML elements. Consequently, the remote
request of the CSS selector was not triggered. 0 X ex ic ABC cap
IV. L EAKAGE VIA CSS RULES Fig. 1: The CSS length units ch, ex, ic, and cap are
In this section, we introduce novel CSS fingerprinting specified relative to the dimensions of glyphs of the active
techniques based on previously unexplored at-rules. In Sec- font.
tion IV-A, we show that the recently added @container rule
is well-suited for browser fingerprinting. Container queries
can replace all state-of-the-art techniques for fingerprinting, value. Relative units carry information about the rendering
have fewer requirements, are more challenging to mitigate, environment, e.g., font availability (see Section IV-A1), user
and are applicable in more scenarios. Section IV-B shows that configuration (see Section IV-A2), or the viewport width (see
@supports efficiently distinguishes browsers and browser Section IV-A3). In addition, as showcased by Lin et al.
versions, and @import and @print have privacy implica- [22], the width of HTML elements also presents a great
tions when used in emails. fingerprinting surface (see Section IV-A4).
1) Font Detection: We can infer if a particular font is
A. Container Queries available on a system using one or multiple font-relative units.
Container queries (@container rules) introduce the con- As sizes of characters differ between glyphs and fonts, they
ditional application of styles depending on the computed size reliably identify a font. As illustrated in Figure 1, the units
of their parent container (e.g., width and height) [25], [37]. ch, ex, and ic refer to concrete sizes of individual glyphs,
Listing 2 shows an example of a container query combining while cap refers to the height of capital letters of a font [25],
a style with a size query. Modifications to the properties of [38]. Here, ch represents the advance width of the glyph that
the container propagate to its child elements via the container represents the character ‘0’ of the current font. Similarly, for
query. A container query can be a boolean combination of international fonts, the ic unit represents the height of ‘ ’
multiple container conditions. A container condition may (CJK water ideograph, U+6C34). The unit ex is defined as
query a size feature of the container or perform a style query the height of the glyph representing the character ‘X’ of a
to query the computed style of the container. Currently, style font. Similarly, the unit cap is the approximate height of a
queries are only implemented for the capital Latin letter.
CSS data type [25]. The W3C working draft does, however, To test if a specific font is installed and available to the
not mention this restriction [37]. browser, we proceed as follows. We create two containers
We introduce a novel technique that leverages a comparison with the same width of this unit type. We assign the font
of the width (or height) of a container specified using a relative we want to test for to only one of the containers. We infer the
unit and a baseline value specified in an absolute unit (px). actual size of the container by comparing it to an absolute unit,
The technique allows us to infer the absolute size of a relative such as px. Directly comparing the width of the container is
unit, e.g., lh (relative to line-height), or vw (relative not possible. By comparing the measurements of the container
to the viewport width). Using multiple container queries, with the default fallback font applied to the container with the
boolean combinations, or nesting, we find the exact absolute font we want to test for, we can observe if a font is available.
5
2) Default Property Values: The unit lh is defined as the
current value of the line-height property. While this value fit fit
is independent of the viewport, each major browser ships with
different default line heights. For example, the default value is fixed width
18 in Google Chrome and 19 in Firefox. In contrast, the default
font size in all major desktop browsers is 16. However, this
value is customizable and may uniquely identify users. expands
3) Replicating Media Queries: The @media at-rule, as Fig. 2: We can measure the width of an HTML element, e.g.,
used in previous work [22], [30], can query information about a