[quotheth]

An attacker needs the ability to compute on your local machine. Javascript is the way to do that in a browser.

With just CSS this should be impossible/ very unlikely. I guess it is probably technically possible, but I do not expect to see exploits using just CSS.

With HTML5 idk, that's really outside of my area.