CSS based Attack: Abusing unicode-range of @font-face

In this post, I would like to share about new CSS based attack with unicode-range descriptor of @font-face rule. Using this technique, an attacker can read page's text partially by CSS only. An attacker might use this technique in the following cases: - Browser's XSS filter bypass (e.g. XSS Auditor does not block <style> injection) - Only CSS injection is allowed in the target page As far as I kno