---
id: 5512
title: "Abusing jQuery for CSS powered timing attacks"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/abusing-jquery-for-css-powered-timing-attacks"
published_at: "2019-05-29T12:10:00Z"
tags: ["browser-security", "portswigger", "side-channel", "red-hat", "timing-attack", "jquery", "css-selectors"]
phying_url: "https://phying.com/item/5512"
lang: en
---

# Abusing jQuery for CSS powered timing attacks

## Summary

Gareth Heyes turns jQuery's :has and :contains selectors into a timing side-channel, extracting data such as a logged-in user's full name on sites passing location.hash to $().

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2019-05-29T12:10:00Z
- **Original:** https://portswigger.net/research/abusing-jquery-for-css-powered-timing-attacks
- **Phying News:** https://phying.com/item/5512