CSS tracking - Revision history

Rudxain at 21:07, 26 April 2026

2026-04-26T21:07:33Z

← Older revision		Revision as of 21:07, 26 April 2026
Line 6:		Line 6:
	CSS can declare that certain resources/assets be used ''if'' certain conditions are met.<ref>https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries</ref> Since browsers implement [[wikipedia:Lazy_loading\|lazy-loading]], this means that assets will only be requested ''when'' the conditions are met. This effectively allows [[wikipedia:Ping_(networking_utility)\|pinging]] arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"[https://www.gnu.org/philosophy/who-does-that-server-really-serve.html server]" to gather more data about user behavior.<ref>https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense</ref><ref>https://portswigger.net/research/inline-style-exfiltration</ref>		CSS can declare that certain resources/assets be used ''if'' certain conditions are met.<ref>https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries</ref> Since browsers implement [[wikipedia:Lazy_loading\|lazy-loading]], this means that assets will only be requested ''when'' the conditions are met. This effectively allows [[wikipedia:Ping_(networking_utility)\|pinging]] arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"[https://www.gnu.org/philosophy/who-does-that-server-really-serve.html server]" to gather more data about user behavior.<ref>https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense</ref><ref>https://portswigger.net/research/inline-style-exfiltration</ref>

	Traditionally, CSS tracking was (and still is) implemented as a limited [[Fingerprinting\|finger printer]], typically by enumerating installed fonts and checking window dimensions.{{Citation needed}}		Traditionally, CSS tracking was (and still is) implemented as a limited [[Fingerprinting\|finger-printer]], typically by enumerating installed fonts and checking window dimensions.{{Citation needed}}

	Either way, the attack has limitations, as [[wikipedia:Cache_(computing)\|caching]] avoids (no guarantee) repeated requests from happening.		Either way, the attack has limitations, as [[wikipedia:Cache_(computing)\|caching]] avoids (no guarantee) repeated requests from happening.

	==Why it is a problem==		==Why it is a problem==
	Though CSS is widely believed to be "just a declarative styling system" with no practical compute power, it is actually a ~~virtually~~ [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical Turing-complete] programming language,<ref>https://lyra.horse/x86css/</ref><ref>https://lyra.horse/css-clicker/</ref> a fact which may leave even the most privacy-minded users vulnerable to tracking.{{Citation needed}} This mode of attack breaks the common belief that [[wikipedia:HTML\|HTML]] and CSS can only be used to make static/passive documents, whilst [[JavaScript]] represents the real "threat" to be countered through disabling.{{Citation needed}}<!-- Chromium disables HTML-based lazy-loading when JS is disabled, for privacy reasons. But it doesn't disable lazy-load for CSS -->		Though CSS is widely believed to be "just a declarative styling system" with no practical compute power, it is actually a [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical virtually Turing-complete] programming language,<ref>https://lyra.horse/x86css/</ref><ref>https://lyra.horse/css-clicker/</ref> a fact which may leave even the most privacy-minded users vulnerable to tracking.{{Citation needed}} This mode of attack breaks the common belief that [[wikipedia:HTML\|HTML]] and CSS can only be used to make static/passive documents, whilst [[JavaScript]] represents the real "threat" to be countered through disabling.{{Citation needed}}<!-- Chromium disables HTML-based lazy-loading when JS is disabled, for privacy reasons. But it doesn't disable lazy-load for CSS -->

	==Examples==		==Examples==

IWillRememberMyPassword: /* Why it is a problem */

2026-04-26T17:01:53Z

Why it is a problem

← Older revision		Revision as of 17:01, 26 April 2026
Line 11:		Line 11:

	==Why it is a problem==		==Why it is a problem==
	Though CSS is widely believed to be "just a declarative styling ~~language~~" with no practical compute power, it is actually a virtually [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical Turing-complete] language,<ref>https://lyra.horse/x86css/</ref><ref>https://lyra.horse/css-clicker/</ref> a ~~reality~~ which may leave even the most privacy-minded users vulnerable to tracking.{{Citation needed}} This mode of attack breaks the common belief that [[wikipedia:HTML\|HTML]] and CSS can only be used to make static/passive documents, whilst [[JavaScript]] represents the real "threat" to be countered through disabling.{{Citation needed}}<!-- Chromium disables HTML-based lazy-loading when JS is disabled, for privacy reasons. But it doesn't disable lazy-load for CSS -->		Though CSS is widely believed to be "just a declarative styling system" with no practical compute power, it is actually a virtually [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical Turing-complete] programming language,<ref>https://lyra.horse/x86css/</ref><ref>https://lyra.horse/css-clicker/</ref> a fact which may leave even the most privacy-minded users vulnerable to tracking.{{Citation needed}} This mode of attack breaks the common belief that [[wikipedia:HTML\|HTML]] and CSS can only be used to make static/passive documents, whilst [[JavaScript]] represents the real "threat" to be countered through disabling.{{Citation needed}}<!-- Chromium disables HTML-based lazy-loading when JS is disabled, for privacy reasons. But it doesn't disable lazy-load for CSS -->

	==Examples==		==Examples==

IWillRememberMyPassword: Flow of reading, tone moderation to neutrality (see Neutral POV / Editorial guidleines), etc. See Discussion page for more.

2026-04-26T16:49:23Z

Flow of reading, tone moderation to neutrality (see Neutral POV / Editorial guidleines), etc. See Discussion page for more.

← Older revision		Revision as of 16:49, 26 April 2026
Line 1:		Line 1:
	{{StubNotice}}		{{StubNotice}}

	'''[[wikipedia:CSS\|CSS]]-based tracking''' and '''[[wikipedia:CSS_fingerprinting\|CSS fingerprinting]],''' consist on abusing the semantics of CSS, in order to trick web-browsers to send data to servers.		'''[[wikipedia:CSS\|CSS]]-based tracking''' and '''[[wikipedia:CSS_fingerprinting\|CSS fingerprinting]]''' consist of abusing the semantics of CSS, a styling language used to present virtually all web-pages, in order to trick web-browsers to send data to servers.

	==How it works==		==How it works==
	CSS can declare that certain resources/assets be used ''if'' certain conditions are met.<ref>https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries</ref> Since browsers implement [[wikipedia:Lazy_loading\|lazy-loading]], this means that assets will only be requested ''when'' the conditions are met. This effectively allows [[wikipedia:Ping_(networking_utility)\|pinging]] arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"[https://www.gnu.org/philosophy/who-does-that-server-really-serve.html server]" to gather more data about user behavior.<ref>https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense</ref><ref>https://portswigger.net/research/inline-style-exfiltration</ref>		CSS can declare that certain resources/assets be used ''if'' certain conditions are met.<ref>https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries</ref> Since browsers implement [[wikipedia:Lazy_loading\|lazy-loading]], this means that assets will only be requested ''when'' the conditions are met. This effectively allows [[wikipedia:Ping_(networking_utility)\|pinging]] arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"[https://www.gnu.org/philosophy/who-does-that-server-really-serve.html server]" to gather more data about user behavior.<ref>https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense</ref><ref>https://portswigger.net/research/inline-style-exfiltration</ref>

	Traditionally, CSS tracking was (and still is) implemented as a limited [[Fingerprinting\|~~fingerprinter~~]], typically by enumerating installed fonts and checking window dimensions.{{Citation needed}}		Traditionally, CSS tracking was (and still is) implemented as a limited [[Fingerprinting\|finger printer]], typically by enumerating installed fonts and checking window dimensions.{{Citation needed}}

	Either way, the attack has limitations, as [[wikipedia:Cache_(computing)\|caching]] avoids (no guarantee) repeated requests from happening.		Either way, the attack has limitations, as [[wikipedia:Cache_(computing)\|caching]] avoids (no guarantee) repeated requests from happening.

	==Why it is a problem==		==Why it is a problem==
	~~This is an insidious practice, as~~ CSS is widely believed to be "just a declarative styling language", ~~even though~~ it's [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical ~~practically~~ Turing-complete].<ref>https://lyra.horse/x86css/</ref><ref>https://lyra.horse/css-clicker/</ref> ~~Even~~ privacy-minded users ~~have this misconception, which makes them equally~~ vulnerable to ~~this class of~~ tracking.{{Citation needed}} ~~Most people believe that simply disabling [[JavaScript\|Javascript]] is enough.~~ This attack breaks the ~~expectation~~ that [[wikipedia:HTML\|HTML]] and CSS can only be used to make static/passive documents.<!-- Chromium disables HTML-based lazy-loading when JS is disabled, for privacy reasons. But it doesn't disable lazy-load for CSS -->		Though CSS is widely believed to be "just a declarative styling language" with no practical compute power, it is actually a virtually [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical Turing-complete] language,<ref>https://lyra.horse/x86css/</ref><ref>https://lyra.horse/css-clicker/</ref> a reality which may leave even the most privacy-minded users vulnerable to tracking.{{Citation needed}} This mode of attack breaks the common belief that [[wikipedia:HTML\|HTML]] and CSS can only be used to make static/passive documents, whilst [[JavaScript]] represents the real "threat" to be countered through disabling.{{Citation needed}}<!-- Chromium disables HTML-based lazy-loading when JS is disabled, for privacy reasons. But it doesn't disable lazy-load for CSS -->

	==Examples==		==Examples==

Rudxain: links (inter & ext)

2026-04-26T02:38:29Z

links (inter & ext)

← Older revision		Revision as of 02:38, 26 April 2026
Line 4:		Line 4:

	==How it works==		==How it works==
	CSS can declare that certain resources/assets be used ''if'' certain conditions are met.<ref>https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries</ref> Since browsers implement [[wikipedia:Lazy_loading\|lazy-loading]], this means that assets will only be requested ''when'' the conditions are met. This effectively allows [[wikipedia:Ping_(networking_utility)\|pinging]] arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"server" to gather more data about user behavior.<ref>https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense</ref><ref>https://portswigger.net/research/inline-style-exfiltration</ref>		CSS can declare that certain resources/assets be used ''if'' certain conditions are met.<ref>https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries</ref> Since browsers implement [[wikipedia:Lazy_loading\|lazy-loading]], this means that assets will only be requested ''when'' the conditions are met. This effectively allows [[wikipedia:Ping_(networking_utility)\|pinging]] arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"[https://www.gnu.org/philosophy/who-does-that-server-really-serve.html server]" to gather more data about user behavior.<ref>https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense</ref><ref>https://portswigger.net/research/inline-style-exfiltration</ref>

	Traditionally, CSS tracking was (and still is) implemented as a limited [[Fingerprinting\|fingerprinter]], typically by enumerating installed fonts and checking window dimensions.{{Citation needed}}		Traditionally, CSS tracking was (and still is) implemented as a limited [[Fingerprinting\|fingerprinter]], typically by enumerating installed fonts and checking window dimensions.{{Citation needed}}
Line 11:		Line 11:

	==Why it is a problem==		==Why it is a problem==
	This is an insidious practice, as CSS is widely believed to be "just a declarative styling language", even though it's [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical practically Turing-complete].<ref>https://lyra.horse/x86css/</ref><ref>https://lyra.horse/css-clicker/</ref> Even privacy-minded users have this misconception, which makes them equally vulnerable to this class of tracking.{{Citation needed}} Most people believe that simply disabling [[JavaScript\|Javascript]] is enough. This attack breaks the expectation that HTML and CSS can only be used to make static/passive documents.<!-- Chromium disables HTML-based lazy-loading when JS is disabled, for privacy reasons. But it doesn't disable lazy-load for CSS -->		This is an insidious practice, as CSS is widely believed to be "just a declarative styling language", even though it's [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical practically Turing-complete].<ref>https://lyra.horse/x86css/</ref><ref>https://lyra.horse/css-clicker/</ref> Even privacy-minded users have this misconception, which makes them equally vulnerable to this class of tracking.{{Citation needed}} Most people believe that simply disabling [[JavaScript\|Javascript]] is enough. This attack breaks the expectation that [[wikipedia:HTML\|HTML]] and CSS can only be used to make static/passive documents.<!-- Chromium disables HTML-based lazy-loading when JS is disabled, for privacy reasons. But it doesn't disable lazy-load for CSS -->

	==Examples==		==Examples==

Rudxain: Created page with "{{StubNotice}} '''CSS-based tracking''' and '''CSS fingerprinting,''' consist on abusing the semantics of CSS, in order to trick web-browsers to send data to servers. ==How it works== CSS can declare that certain resources/assets be used ''if'' certain conditions are met.https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries Since browsers implement lazy-loading, thi..."

2026-04-26T01:05:13Z

Created page with "{{StubNotice}} '''CSS-based tracking''' and '''CSS fingerprinting,''' consist on abusing the semantics of CSS, in order to trick web-browsers to send data to servers. ==How it works== CSS can declare that certain resources/assets be used ''if'' certain conditions are met.<ref>https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries</ref> Since browsers implement lazy-loading, thi..."

New page

{{StubNotice}}

'''[[wikipedia:CSS|CSS]]-based tracking''' and '''[[wikipedia:CSS_fingerprinting|CSS fingerprinting]],''' consist on abusing the semantics of CSS, in order to trick web-browsers to send data to servers.

==How it works==
CSS can declare that certain resources/assets be used ''if'' certain conditions are met.<ref>https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries</ref> Since browsers implement [[wikipedia:Lazy_loading|lazy-loading]], this means that assets will only be requested ''when'' the conditions are met. This effectively allows [[wikipedia:Ping_(networking_utility)|pinging]] arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"server" to gather more data about user behavior.<ref>https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense</ref><ref>https://portswigger.net/research/inline-style-exfiltration</ref>

Traditionally, CSS tracking was (and still is) implemented as a limited [[Fingerprinting|fingerprinter]], typically by enumerating installed fonts and checking window dimensions.{{Citation needed}}

Either way, the attack has limitations, as [[wikipedia:Cache_(computing)|caching]] avoids (no guarantee) repeated requests from happening.

==Why it is a problem==
This is an insidious practice, as CSS is widely believed to be "just a declarative styling language", even though it's [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical practically Turing-complete].<ref>https://lyra.horse/x86css/</ref><ref>https://lyra.horse/css-clicker/</ref> Even privacy-minded users have this misconception, which makes them equally vulnerable to this class of tracking.{{Citation needed}} Most people believe that simply disabling [[JavaScript|Javascript]] is enough. This attack breaks the expectation that HTML and CSS can only be used to make static/passive documents.

==Examples==
{{Ph-T-E}}

==References==
{{reflist}}
[[Category:Theme]]