The issue allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS) pseudo-classes. This is related to the lack of protection for internal browser data. An attacker can exploit this to gain access to the full list of disabled plugins using CSS and pseudo-classes.