Preventing User Dictionary Leaks via ::spelling-error and ::grammar-error CSS Pseudo-Elements

[arichiv]

Proposal author(s)

@arichiv, @arturjanc, @Ladankhamnian

Title of the proposal

Preventing User Dictionary Leaks via ::spelling-error and ::grammar-error CSS Pseudo-Elements

URL to the spec's repository

https://github.com/explainers-by-googlers/user-dictionary-leaks

Issue Tracker URL

https://crbug.com/415712674

Explainer URL

https://explainers-by-googlers.github.io/user-dictionary-leaks/

TAG Design Review URL

w3ctag/design-reviews#1148

Mozilla standards-positions issue URL

mozilla/standards-positions#1294

Description

We want to prevent websites from extracting information about a user’s dictionary using CSS spelling/grammar hint highlights. This is currently possible by making a text field with a repeated (misspelled) word autofocus and monitoring rendering performance to notice when highlighting occurs.

[Ahmad-S792]

@vitorroriz & @nt1m

[nt1m]

@pxlcoder implemented support for those pseudo-elements. cc @megangardner @hortont424 too

[arichiv]

I should note that WebKit/Safari is already in compliance with this proposal AFAIK (while Blink/Chrome and Firefox are not), it's just not a part of the formal spec.

[annevk]

Is the plan to document this activation state of form controls in the HTML Standard?

[arichiv]

The current plan is to add to https://drafts.csswg.org/css-pseudo/#highlight-security, but I'm not opposed to other modifications.

[annevk]

I think it would be beneficial to track it in HTML just like we do user activation for windows/documents. That way we can build other things on top as well.

[arichiv]

Okay, I can't promise that I'll do that integration but I'll keep it in mind