XS-Leaks: Turning the Browser Into a Side Channel

Same-origin policy defeated by observation: error-event oracles, frame counting via window.length, connection-pool timing, cache probing, and char-by-char XS-Search