But either way, the element still exists in the HTML; the CSS just affects how they display in the browser. For a form, the input tags still exist and will still send their value="" attributes to ...

But CSS Exfil is not an infallible method. It can only steal HTML attributes found on the page at load time, and not from dynamically injected code after the initial page load. Gualtieri argues ...