Hacker News Reader

Couldn't an attacker override window.getComputedStyle() at runtime anyway?

Presumably Facebook would have CSP headers set on some of the scripts they load to prevent JavaScript on the page from interacting with their own scripts.

Reply on news.ycombinator.com