Does JS protect against this particular attack? It seems like it's mostly implemented in CSS and SVG.