[whatwg/fullscreen] Spoof/Attack vector for fullscreen spec (Issue #254)

theIDinside created an issue (whatwg/fullscreen#254)

### What is the issue with the Fullscreen API Standard?

The bug described on bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=2021080 lays out this problem:

HTML:
- you have an iframe
- it has a sibling div (or whatever)

Steps to reproduce:
- the iframe has an element go fullscreen, a video like in the example
- the page hosting the iframe, sets `display: none` for the iframe, effectively hiding it
- The sibling div now is visible instead, which can spoof the user by looking as though it belongs to the \<iframe\> page

The spec would need some normative wording that says something like "run the removing steps for element if it's display becomes none, or if the subtree it belongs to becomes invisible" (somehow)

Removing steps can be found [here](https://fullscreen.spec.whatwg.org/#ref-for-concept-node-remove-ext).

cc @zcorpan 

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fullscreen/issues/254
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fullscreen/issues/254@github.com>