Reading a bot username through a CSS :has() oracle that drives window.length across origins, under a CSP with no subresource holes and COOP disabled on plain http
Beating an event-handler blocklist and a strict CSP with an onfocus payload and a top-level navigation leak
