JavaScript Zero: real JavaScript, and zero side-channel attacks https://blog.acolyer.org/2018/03/13/javascript-zero-real-jav...

Side-Channel Attacks on Everyday Applications https://github.com/defuse/flush-reload-attacks

The DrK (De-randomizing Kernel ASLR) attack https://github.com/sslab-gatech/DrK

Cache Template Attacks https://github.com/IAIK/cache_template_attacks

Using Node.js Event Loop for Timing Attacks https://snyk.io/blog/node-js-timing-attack-ccc-ctf/

Cross Frame Scripting https://www.owasp.org/index.php/Cross_Frame_Scripting

Cross Frame Scripting (XFS) Cheat Sheet, Attack Examples & Protection https://www.checkmarx.com/knowledge/knowledgebase/XFS

Testing for CSS Injection (OTG-CLIENT-005) https://www.owasp.org/index.php/Testing_for_CSS_Injection_(O...

Stealing CSRF tokens with CSS injection (without iFrames) https://github.com/dxa4481/cssInjection

Stealing Data With CSS: Attack and Defense https://www.mike-gualtieri.com/posts/stealing-data-with-css-...

Reading Data via CSS Injection https://curesec.com/blog/article/blog/Reading-Data-via-CSS-I...