v143 · user input

Restricting spelling and grammar highlights

This experiment would change when spelling and grammar hints are applied to text fields to reduce the of websites ability to extract information about the user’s dictionary, specifically: * Hints would not be applied to a text field that has not had user interaction (an autofocus is insufficient, there must be a click or key press of some kind relative to t

concepts

  1. Spellcheck Restriction

    Side-by-side textareas, one autofocused on load. v143 holds spellcheck highlights until the user actually interacts; observe the difference in real time with an event log.

  2. Dictionary leak probe

    Reproduces the actual exploit: time how long a programmatic spellcheck takes on each candidate word. Pre-v143 leaks dictionary membership through timing; v143 fences it.

  3. Subtree policy tester

    A page with four annotated subtrees (passwords, credentials, public blog body, code block). Toggle page-level and per-zone spellcheck values; the auditor reports which fields would still leak text to the dictionary service under v143's rules.

  4. Highlight Privacy Audit

    Five live document regions (normal editable, spellcheck="false", shadow DOM, CSS Custom Highlights, sandboxed iframe) with a "Before v143" / "Chrome 143+" toggle. A "Run audit" button produces a per-region checklist with contained/leaks status and explanatory text, plus a CSS Custom Highlights demo using CSS.highlights.set() with apply/clear buttons.

why it shipped

The user’s dictionary may contain sensitive information, for example some operating systems import the contents of the user’s address book to assist with the spelling of names/addresses. Although direct indicators of the ::spelling-error and ::grammar-error cannot be extracted, it’s possible to extract indirect information from browsers without rate limits on the application of these hints. In Chrome and Firefox, it’s possible to have an autofocused text area cycle programmatically through a series of misspelled words, and for the site to monitor indicators of rendering performance to notice w

references