15 ms·
This isn't the first time a color-exfiltration vulnerability has been found in CSS. Disappointing that we're revisiting this same issue.
by maxk42 8y ago
This isn't the first time a color-exfiltration vulnerability has been found in CSS. Disappointing that we're revisiting this same issue.
- bsimpson 8y agoI believe this is also why there's not a CSS equivalent of Adobe's Pixel Bender shader system. They're worried that someone could write a shader that would detect sensitive info (like a credit card number) and jank the render thread in an observable way to leak the number to a script running in the parent window.
- Bjartr 8y agoActually, CSS shaders are a thing, but can't access DOM content pixels for exactly that reason. http://alteredqualia.com/css-shaders/article/ http://alteredqualia.com/css-shaders/article/