demo · v143
Dictionary leak probe
The attack this feature blocks: an autofocused textarea cycles through candidate words, and the page measures whether each one took the slow path (highlighted by spellcheck) or the fast path (not in the dictionary, hence unhighlighted). Time differences leak dictionary contents.
safe demo — this page simulates the attack against itself, with the word list visible. It does not exfiltrate. On v143, the textarea is not interacted with so spellcheck stays off — no timing signal to extract.
candidate dictionary (edit if you want)
probe textarea (autofocused, never interacted with)
per-word render times
Click Run timing probe.
the attack (pre-v143)
// 1. Autofocus a hidden textarea with spellcheck on.
// 2. Programmatically set its value to each candidate word.
// 3. Measure how long the next frame takes.
// 4. Words IN the user's dictionary cost more (squiggle render);
// words NOT in the dictionary cost less.
// v143 fence: spellcheck highlights are deferred until the user
// actually interacts with the field. Autofocus alone is not enough.why this angle
The other concept shows side-by-side textareas with the autofocus difference visible. This one reproduces the actual exploit — timing-based dictionary inference — so you can see what v143 blocks. The verdict tells you whether your browser shipped the fence.