Collected research

Steal History without JavaScript

I still know where you've been, without JavaScript

Jeremiah Grossman · blog.jeremiahgrossman.com

Points at RSnake's rework of CSS history stealing that needs no JavaScript: rather than reading link colour from script, the a:visited rule drives a display: property so the browser itself requests a per-link resource, leaking the visit to the server. Notes SafeHistory as partial mitigation and pdp's improved proof of concept.

Record

Document

I still know where you've been, without JavaScript

Researcher

Jeremiah Grossman

Published by

blog.jeremiahgrossman.com

Topic

Server

In the archive

• Collected in the 2007 research round

Tags

• css
• xsleak
• info-leak
• side-channel
• deanonymization
• prior-art-extension

This page is the archive's own catalogue record. The research is the work of Jeremiah Grossman, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.