1
In addition to allowing potential attacker to fake the user interface to look like something else (e.g. make new forum message form look like login form) there's a possibility of side-channel data leak to external service.
Some example attack vectors:
https://portswigger.net/daily-swig/a-dangerous-blend-side-channel-attack-exploits-css-vulnerability
https://...
Only top voted, non community-wiki answers of a minimum length are eligible
