Matryoshka: Wrapping Overflow Leak on Frames

Fascinating.<p>Is it correct to say that extracting information about the text in a target iframe using this attack depends on knowing the pixel widths of all the characters in the font used in an arbitrary line of text in the target iframe?

From the headline, i first thought about the MKV video container and video frames. :)

Good thing I do not run Javascript, esp. when items are fetched from other domains:<p><a href="http://postimg.org/image/3m9v8eyrx/" rel="nofollow">http:&#x2F;&#x2F;postimg.org&#x2F;image&#x2F;3m9v8eyrx&#x2F;</a><p>I wonder how many people are still naive, and just leave it JS on, no questions asked..

Could the browser make small fractional random changes (+&#x2F;-1 px) to the requested iframe size to avoid this attack?