fix w3c#4697

Author: svgeesus

css-fonts-4/Overview.bs

@@ -6419,6 +6419,10 @@ No.
 
 For third-party Web Fonts loaded via a stylesheet,
 the stylesheet origin may be exposed to the third party in the Referer header.
+In addition, careful pairing of unicode-range and distinct src urls
+allows the third-party to see which characters are used on a page,
+which is a privacy risk for large character repertoire scripts
+such as CJK.
 
 For third-party Web Fonts preloaded in the HTML,
 the document origin may be similarly exposed.