From f8e5bf77287b6d8712b054e6651472b7babeeb38 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 9 Jun 2026 17:22:16 +0200 Subject: [PATCH 1/3] Define privacy-preserving rendering --- source | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/source b/source index 640465da59f..79ff011c402 100644 --- a/source +++ b/source @@ -151602,6 +151602,9 @@ legend[align=right i] { video element, as defined by the relevant rendering rules; for WebVTT, those are the rules for updating the display of WebVTT text tracks. WEBVTT

+

In privacy-preserving rendering, subtitles and captions are expected + to be rendered with default appearance that ignores any user preferences.

+

When the user agent starts exposing a user interface for a video element, the user agent should run the rules for updating the text track rendering of each of the text @@ -153312,6 +153315,10 @@ select { elements in their user interface, as discussed previously.

+

In privacy-preserving rendering, user agents are expected to act as + if the :visited pseudo-class does not + match.

+ @@ -153550,6 +153557,35 @@ if (s = prompt('What is your name?')) { +

Privacy-preserving rendering

+ +

In privacy-preserving rendering, any security- or privacy-sensitive + information that isn't otherwise observable to author code are omitted or replaced with safe + defaults. The detailed requirements are in the relevant sections above.

+ +

In privacy-preserving rendering, the user agent is expected to:

+ +

Summary

+ + + +

The following table summarizes how privacy-preserving rendering affects various + elements and features when they are rendered:

+ + + + + + + +
Category + Expected behavior +
a and area elements + The :visited pseudo-class never matches. +
Media elements + Subtitles and captionss use default appearance, ignoring any user preferences. +
+

Obsolete features

From 9b2ed380f15401fd3a1b268e7595c3b28c872430 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 16 Jun 2026 13:41:01 +0000 Subject: [PATCH 2/3] Rename privacy-preserving rendering to read-back-allowed rendering And s/in/during/ --- source | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/source b/source index 79ff011c402..4b1bd04eafb 100644 --- a/source +++ b/source @@ -151602,8 +151602,9 @@ legend[align=right i] { video element, as defined by the relevant rendering rules; for WebVTT, those are the rules for updating the display of WebVTT text tracks. WEBVTT

-

In privacy-preserving rendering, subtitles and captions are expected - to be rendered with default appearance that ignores any user preferences.

+

During read-back-allowed rendering, subtitles and captions are + expected to be rendered with default appearance that ignores any user + preferences.

When the user agent starts exposing a user interface for a video element, the user agent should run the rules for @@ -153315,8 +153316,8 @@ select { elements in their user interface, as discussed previously.

-

In privacy-preserving rendering, user agents are expected to act as - if the :visited pseudo-class does not +

During read-back-allowed rendering, user agents are expected to act + as if the :visited pseudo-class does not match.

@@ -153557,19 +153558,17 @@ if (s = prompt('What is your name?')) { -

Privacy-preserving rendering

+

Read-back-allowed rendering

-

In privacy-preserving rendering, any security- or privacy-sensitive +

During read-back-allowed rendering, any security- or privacy-sensitive information that isn't otherwise observable to author code are omitted or replaced with safe defaults. The detailed requirements are in the relevant sections above.

-

In privacy-preserving rendering, the user agent is expected to:

-

Summary

-

The following table summarizes how privacy-preserving rendering affects various +

The following table summarizes how read-back-allowed rendering affects various elements and features when they are rendered:

From f22bc53e7ad1aff5a82bfc6c8184bd9709e9322e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 16 Jun 2026 14:17:33 +0000 Subject: [PATCH 3/3] Move list over from HTML-in-Canvas PR --- source | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/source b/source index 4b1bd04eafb..33f70eadb11 100644 --- a/source +++ b/source @@ -4210,6 +4210,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • <length>
    • +
  • <url>
  • The 'em' unit
  • The 'ex' unit
  • The 'vw' unit
    • @@ -153564,6 +153565,50 @@ if (s = prompt('What is your name?')) { information that isn't otherwise observable to author code are omitted or replaced with safe defaults. The detailed requirements are in the relevant sections above.

    + +

    The following must not be exposed during read-back-allowed rendering:

    + +
    +
    All content +
    CORS-cross-origin content, including in embedded content (e.g., + iframe, img), canvas elements whose bitmap's origin-clean flag is set to false, CSS + <url> references (e.g., 'background-image', + 'border-image-source'), and SVG elements (e.g., use, pattern, feImage). +
    Non-default colors, themes, and preferences. +
    Non-default selection and find-in-page highlights. +
    Spelling and grammar markers. +
    Subpixel text rendering and antialiasing. + +
    Form-associated elements +
    Platform-specific appearance. +
    Pending autofill suggestions. + +
    Media elements +
    User preferences for caption and subtitle selection and appearance. + +
    a and area elements +
    Visited link information. +
    + +

    The above cases should all be merged into the appropriate part of the rendering + section.

    + +

    The following explicitly may be exposed during read-back-allowed rendering:

    + +
    +
    All content +
    Matching text from find-in-page. + +
    Form-associated elements +
    Default appearance that is the same on all platforms. + +
    iframe and frame elements +
    CORS-same-origin frames are not sensitive information, but + CORS-cross-origin content within them is.
    +
    +

    Summary