A new CSS feature added in Chrome, Firefox, Opera, and Safari can reveal the links a user has visited in the past if they're stored in their browser's history.
The problem of CSS leaking user history was discussed before, more precisely around the turn of the decade. Security researchers realized that they could use the getComputedStyle API function present in all browsers to detect how the user's browser colors a link inside a page, if the site used "a:visited" CSS selectors to visibly mark previously visited URLs.
Browser makers have somewhat addressed this issue by making the attack more costly to carry out, with users required to click on each link.
Zalewski leaked user browser history via CSS in the past
One of the people who created a proof-of-concept demo for this type of attack was Google engineer Michal Zalewski. This happened in 2013, and Zalewski concluded that such attacks were impractical and hard to pull off.
