It’s a timing vulnerability, based on how long it takes the GPU to render the page , I think, although it’s also browser specific.
But seems low risk… at a minimum of 30 minutes to grab a username, you’d have to be sat on the same page for a while and not notice your fans ramping up…
Also, passwords seems a stretch. No (sane) site displays passwords.