This line particularly caught my eye: > It was quite surprising for us to find out that the blend mode layers were able to interact with cross-origin iframes i

This line particularly caught my eye: > It was quite surprising for us to find out that the blend mode layers were able to interact with cross-origin iframes in the first place so we investigated this further. Because a few years ago I was wondering the same thing; Someone figured out a side-channel timing attack using SVG filters, exploiting differing execution times of code paths in the Erode filter (probably also in the Dilate filter but they only needed one). IIRC, they could even apply it to an iframe with a source:// URL of another domain (probably FB again), of which they could control the scrollbars and scroll into view the session key that showed up in the HTML source somewhere. This raised a couple of questions with me ... Why can we put a source:// URL in an iframe at all? Why can we control the scrolled position of content in a cross-domain iframe? And why are SVG filters capable of processing cross-domain content instead of just seeing a black square or something? AFAIK they fixed it by changing the filters, making sure all code-paths were of equal length. Which is part of the right solution because side-channel attacks can come from anywhere (it's kind of their thing). But making the whole system more robust by just not allowing operations on cross-domain content would do a whole lot for plugging many of these bugs. I'm kinda surprised there haven't been a lot more of these. Could be I've missed them though.