Css-Injection

A one-line Node server lets you inject a rel=stylesheet entry into the Link response header, which Firefox applies to the flag-bearing page, enabling CSS attribute-selector exfiltration of the cookie.