INLINE STYLE EXFILTRATION: LEAKING DATA WITH CHAINED CSS CONDITIONALS

Summary from the TLDR InfoSec newsletter

Attackers can now use only inline CSS styles—with the help of chained if statements—to steal sensitive data like user IDs directly from web pages, all without external files or selectors. This creative trick works on Chromium browsers and highlights how inline CSS itself can be a security threat if user-controlled content isn't locked down properly.