MicrosoftEdge / MicrosoftEdge/MSEdgeExplainers
[EyeDropper] Restrict API access to content area
@BoCupp-Microsoft is already working on this.
Since Jan 12, 2021.
- Dominant language
- HTML
- Stars
- 1.4k
- Forks
- 286
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 8
Description
[Writing on behalf of Chrome Security and Privacy teams. CC\ @camillelamy ]
The explainer states this as a goal:
Provide access to the color values of one or more user-selected pixels, including pixels rendered by different origins, or outside of the browser.
However, it is preferable to restrict API access only to the page content area only. Access to the browser window/controls area, or area outside of the browser could make clickjacking attacks possible; and potentially reveal fingerprintable information about the user (e.g. OS preferences).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.