I know what you :visited • Lightning talk
summary
A concrete exploit shows how a redraw timing hack plus abusing CSS :visited and embedded SVG swaps lets code infer whether specific URLs are in history; a prototype toggles pairs of links and measures redraw timing, reaching about 187 swaps/sec, and a utility returns a probability that a given URL was visited. Cross‑browser bug reports exist but remain unfixed, and the author plans to publish the code and push vendor fixes.
AI-written summary · about
