MicrosoftEdge / MicrosoftEdge/MSEdgeExplainers
[AnimationSmoothness] Frame times reveal new privacy/security information
@jenna-sasson is already working on this.
Since Sep 29, 2025.
- Dominant language
- HTML
- Stars
- 1.4k
- Forks
- 286
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 8
Description
The fact that a frame is (or is not) presented reveals new information to javascript. For example, imagine a root page (A) with a cross-origin login iframe (B): script on A can listen to the timing of the frames produced by B, and infer information about the password from the timing of the user's keystrokes. Another scenario is spellcheck: a page can toggle the spellcheck field of an input element and learn whether a word is misspelled based on the presence of a presented frame (for showing the spelling underline), and this contains information about the user's spellcheck dictionary. This information is not in requestAnimationFrame today because requesting a frame causes a new frame to be presented.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.