Highlight Privacy Audit

Before Chrome 143, spelling and grammar highlights from the browser's spellchecker could cross shadow DOM boundaries and appear on content the host page hadn't opted into. This tool audits each region type for highlight containment, and lets you toggle between "before v143" (permissive) and "after v143" (restricted) behaviour.

Live document regions

Spellcheck is ON (spellcheck="true"). Misspelled words should be underlined by the browser.

Spellcheck is OFF. Highlights should not appear here — before v143 this wasn't always honoured across boundaries.

A web component with its own editable field inside a shadow root. Before v143, spell-highlight could leak from the host scope into the shadow, or vice versa.

A custom highlight registered via CSS.highlights.set(). In v143, custom highlights are scoped to their registration origin and cannot bleed across documents or shadow roots.

The custom highlight API lets you mark arbitrary text ranges. This sentence has a custom highlight applied to this specific phrase using CSS.highlights.

A sandboxed iframe represents a cross-origin document boundary. Spell highlights from the parent document must not propagate into the iframe's content.

Audit results

Click "Run audit" above to check each region for highlight containment.

Policy recommendations

spellcheck boundary

Set spellcheck="false" on any editable element that should not show browser spell highlights. In Chrome 143+, this boundary is fully enforced even across shadow DOM slots.

Shadow DOM host

Setting spellcheck="false" on the shadow host does NOT automatically propagate to slotted light-DOM content in pre-v143 browsers. In v143+, the restriction is inherited correctly. For maximum compatibility, also set it on the slotted element.

Custom highlights

Register all custom highlights in the same document scope where the text lives. Highlights registered in the top-level document will not bleed into shadow roots or iframes in Chrome 143+. Use CSS.highlights.set('name', highlight) per-scope.

Cross-origin iframe

Cross-origin iframes always have a separate browsing context. Parent spell highlights never cross the iframe boundary regardless of version. If you embed third-party content, its spellcheck state is fully isolated from your document.

Dictionary leak prevention

Before v143, spelling highlights could reveal whether a word is in the user's personal dictionary — a privacy leak. Chrome 143 restricts highlight rendering to prevent cross-origin and cross-shadow fingerprinting via spelling states. No attribute change needed; the protection is automatic.