Would you care to enlighten us houseplants as to how? The :visited selector is limited to a very small subset of CSS properties[1] for exactly this reason; I’m sure if you have an exploit that can be used to extract browsing history the browsers will be very interested in a security report.
[1]: https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...