Collected research
Bench Press: Leaking Text Nodes with CSS
CSS injected into a <style> tag, under a CSP that blocks scripts and remote fonts. Each hex digit gets an @font-face with unicode-range and descent-override for a unique height; a view-timeline animation reads the element's height into a CSS variable, ::first-line font shrinking exposes one more character per step, and the height difference sets the delay of a paused animation whose keyframes hold attacker URLs loaded as background images. Leaks a whole text node, not just its charset.
Record
- Researcher
- pspaul and @pspaul95
- Published by
- pspaul's blog
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of pspaul and @pspaul95, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .