Well, exfiltration via CSS is possible already: https://infosecwriteups.com/exfiltration-via-css-injection-4...
I don't see these new CSS features opening up privacy issues, though.
I don't see these new CSS features opening up privacy issues, though.