[Avamander]

Anyone can preload their domain in Chrome, Firefox and others that share the preload list. I'm not sure what vulnerabilities are left after your site has been preloaded.

[deaps]

The only vulnerability left would be, as mentioned above, a client installing a browser that doesn't support HSTS.

[tedunangst]

If your attack relies on getting the user to install your own browser, don't waste your time with a simple HSTS bypass.