[deaps]

The only vulnerability left would be, as mentioned above, a client installing a browser that doesn't support HSTS.

[tedunangst]

If your attack relies on getting the user to install your own browser, don't waste your time with a simple HSTS bypass.