demo · v143

Subtree policy tester

A page with four annotated subtrees — a password area, a credentials hand-off, a public blog post, and a code block — combined under one form. Toggle spellcheck at the page and per-subtree level and audit which fields would actually leak content to the dictionary service.

Chrome 143 tightens which subtrees may be sent to spell-check / grammar services. The rules are: never on password / credit-card / credentials inputs, never on contenteditable fields whose closest spellcheck attribute resolves to false, and never on <input type=text> when autocomplete is off on a password-context form.

Page-level policy

Top-level <body spellcheck=…>:

Editable subtrees

password zone — never spell-check

credentials hand-off (spellcheck=false)

API key: sk-7XJq…

Recovery phrase: plant carbon photograph fall lonely

public blog body

Type a misspelled werd here. Spellcheck should fire.

code block (spellcheck=false)

function helloWurld() { return 42; }

What the audit reports

  1. For each field, we resolve the effective spellcheck by walking up the DOM (closest spellcheck attribute wins; unset inherits).
  2. For each field, we report whether v143 would block the dictionary call regardless — because of type, autocomplete, or context.
  3. "Leak risk" reflects what would actually go to the spell-check service if the user typed in the field.
// v143 forces this combination:
<input type="password">                           {/* never spell-checked */}
<input type="text" autocomplete="cc-number">     {/* never spell-checked */}
<form autocomplete="off">…</form>                  {/* same on text fields */}

see also