Comment by magicalist

That was in the C++ implementation of the CSS interface that gets exposed to JS, though, there wasn't an exploit from CSS.