Stealing CSRF tokens with CSS injection (without iFrames) - View it on GitHub