MicrosoftEdge / MicrosoftEdge/MSEdgeExplainers

[AnimationSmoothness] Frame times reveal new privacy/security information

Open
#1,164 0 comments 0 reactions 1 assignee View on GitHub

@jenna-sasson is already working on this.

Since Sep 29, 2025.

AnimationSmoothness
Dominant language
HTML
Stars
1.4k
Forks
286
Avg merge
3d 1h
Merged PRs (30d)
8

Description

The fact that a frame is (or is not) presented reveals new information to javascript. For example, imagine a root page (A) with a cross-origin login iframe (B): script on A can listen to the timing of the frames produced by B, and infer information about the password from the timing of the user's keystrokes. Another scenario is spellcheck: a page can toggle the spellcheck field of an input element and learn whether a word is misspelled based on the presence of a presented frame (for showing the spelling underline), and this contains information about the user's spellcheck dictionary. This information is not in requestAnimationFrame today because requesting a frame causes a new frame to be presented.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.