> Once again, the victim's computer does not store any part of CSS. All
> info and software is stored in the assailant's computer.
>
The user has no control of a Web page in using a CSS, none. They wouldn't
know if a CSS was being used, and it hit them dead in their face.
http://www.outfront.net/tutorials_02/adv_tech/css1.htm
However, you are correct in that a CSS or XSS attack not to be confused with
Cascading Style Sheets can be ran against as user. But it's up to the
browser, the Web developer, and the Web site to prevent the attack, not the
end user.
http://www.webopedia.com/TERM/X/XSS.html