

Protecting Browsers from Cross-Origin HTML-parsed-as-CSS Attacks [pdf] - bensummers
http://websec.sv.cmu.edu/css/css.pdf

======
js4all
Interesting article. Cookie-stealing however is not that simple, as all sites
I know in detail, use IP binding. This method renders the cookie useless for
the attacker, as long as he doesn't forge the original IP.

