[edit - just realized this may not answer the question you asked, which is leaks that take advantage of HSTS/HPKP/CSP. hopefully still useful info.] I may writ

[edit - just realized this may not answer the question you asked, which is leaks that take advantage of HSTS/HPKP/CSP. hopefully still useful info.] I may write a blog post later about this, but here are a few that come to mind (only counting things that have demos or have been observed in the wild): * css-visited browser history sniffing (fixed several years ago): http://dbaron.org/mozilla/visited-privacy http://dbaron.org/mozilla/visited-privacy * HSTS unique-subdomain combination supercookies: http://www.radicalresearch.co.uk/lab/hstssupercookies http://www.radicalresearch.co.uk/lab/hstssupercookies * lcamtuf's cache timing attack: http://lcamtuf.coredump.cx/cachetime/ http://lcamtuf.coredump.cx/cachetime/ * webrtc local ip leak: https://diafygi.github.io/webrtc-ips/ https://diafygi.github.io/webrtc-ips/ * panopticlick: https://panopticlick.eff.org/ https://panopticlick.eff.org/ * evercookie: http://samy.pl/evercookie http://samy.pl/evercookie