A malicious website can work out which sites you visit and which apps you open, using nothing but JavaScript and the timing ...