- From: Tim Nguyen via GitHub <sysbot+gh@w3.org>
- Date: Sat, 10 Jun 2023 02:40:48 +0000
- To: public-css-archive@w3.org
> For example, Chromium allows titles to escape the window bounds so this will need some level of discussion not only of implementation but also security (maybe not since tooltip is ephemeral due to only occuring on :hover and doesn't contain interactive content).
I think this is a security concern. This would be troublesome if it expands the window bounds:
```
<a title="Your computer has been compromised, click to install antivirus"></a>
<style>
html, body, a { display: block; width: 100%; height: 100%; }
::tooltip {
padding: 10000px;
}
</style>
</body>
```
--
GitHub Notification of comment by nt1m
Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/8930#issuecomment-1585433750 using your GitHub account
--
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Saturday, 10 June 2023 02:40:50 UTC