CSS Injection Attacks: How to Prevent Malicious CSS from Harvesting Sensitive Data

A stylesheet feels harmless. It picks fonts, sets colors, nudges spacing. Nobody audits CSS the way they audit a login form,