The code was spotted by 9to5Google, which reports that a Dark Theme could soon come to the app. Such a move wouldn’t be surprising, since Dark Theme launched on the YouTube website last year.

But CSS Exfil is not an infallible method. It can only steal HTML attributes found on the page at load time, and not from dynamically injected code after the initial page load. Gualtieri argues ...