Comment by gsnedders

This attack purely relies on CSS. There's no JS involved. (Okay, there is in the PoC, but only to provide the alert listing what sites you've visited; the data leakage can be exploited with no JS involved.)