v156 · capability elements · accessibility tree & anti-spoofing

Accessibility & security guarantees

Hiding the visual text label with display-mode="icon-only" does not weaken capability security or screen-reader semantics. The User Agent locks the element's accessible name in the Accessibility Tree to a trusted localized capability string (rejecting deceptive aria-label="Win a free gift" overrides) and blocks permission activation whenever compositor hit-testing detects partial occlusion or recent layout displacement.

Interactive AXTree & compositor occlusion verifier

1. Capability element & document locale (lang)
2. Spoofing & compositor occlusion test

Compositor Hit-Test Stage Activation: Allowed

Click the icon button above to test whether the UA allows or vetoes the permission prompt under the selected threat scenario.

Computed Accessibility Tree Node (AXNode)

Even with display-mode="icon-only", the UA populates AXNode.name from its internal localized string table.

Live Markup & Security Verdict

Accessibility & compositor anti-spoofing audit
Invariant Page Author Attempt UA Security & A11y Outcome

references & overview