single css injection w/o remote fonts to leak charset ft. @kinugawamasato's unicode-range technique

the trick is using detectable layout differences between default fonts. there are probably many similar and more efficient methos.