CSS Injection

Functionally the same as XSS, but with CSS.

You can steal CSRF tokens by bruteforcing using this method.

Reading Data via CSS Injection - Cureblog