They forgot to add timing attack on images load time which can be used to tell if you visited X website.

https://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010...