my dream browser vuln is one entirely exploitable from CSS, no JS involved. not sure how feasible that really is tho, even with all the modern conditional CSS tricks