Researchers have discovered a weakness in the way Chrome and Firefox interact with Cascading Style Sheets 3 (CSS3) that could have caused them to leak usernames, profile pictures and likes from sites such as Facebook. The chance discovery was made by researcher Ruslan Habalov when he visited Pinterest and noticed it was “displaying my Facebook name and picture inside an iFramed Facebook button.” Probing deeper, they discovered that the problem was CSS3’s mix-blend-modes, introduced in 2016 and fully supported by Chrome desktop/mobile version 49 from March 2016 onwards, and Firefox desktop/mobile version 59 in March this year.

Read full news article on Naked Security