But CSS Exfil is not an infallible method. It can only steal HTML attributes found on the page at load time, and not from dynamically injected code after the initial page load. Gualtieri argues ...