From f8e5bf77287b6d8712b054e6651472b7babeeb38 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 9 Jun 2026 17:22:16 +0200 Subject: [PATCH 01/12] Define privacy-preserving rendering --- source | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/source b/source index 640465da59f..79ff011c402 100644 --- a/source +++ b/source @@ -151602,6 +151602,9 @@ legend[align=right i] { video element, as defined by the relevant rendering rules; for WebVTT, those are the rules for updating the display of WebVTT text tracks. WEBVTT

+

In privacy-preserving rendering, subtitles and captions are expected + to be rendered with default appearance that ignores any user preferences.

+

When the user agent starts exposing a user interface for a video element, the user agent should run the rules for updating the text track rendering of each of the text @@ -153312,6 +153315,10 @@ select { elements in their user interface, as discussed previously.

+

In privacy-preserving rendering, user agents are expected to act as + if the :visited pseudo-class does not + match.

+ @@ -153550,6 +153557,35 @@ if (s = prompt('What is your name?')) { +

Privacy-preserving rendering

+ +

In privacy-preserving rendering, any security- or privacy-sensitive + information that isn't otherwise observable to author code are omitted or replaced with safe + defaults. The detailed requirements are in the relevant sections above.

+ +

In privacy-preserving rendering, the user agent is expected to:

+ +

Summary

+ + + +

The following table summarizes how privacy-preserving rendering affects various + elements and features when they are rendered:

+ + + + + + + +
Category + Expected behavior +
a and area elements + The :visited pseudo-class never matches. +
Media elements + Subtitles and captionss use default appearance, ignoring any user preferences. +
+

Obsolete features

From 9b2ed380f15401fd3a1b268e7595c3b28c872430 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 16 Jun 2026 13:41:01 +0000 Subject: [PATCH 02/12] Rename privacy-preserving rendering to read-back-allowed rendering And s/in/during/ --- source | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/source b/source index 79ff011c402..4b1bd04eafb 100644 --- a/source +++ b/source @@ -151602,8 +151602,9 @@ legend[align=right i] { video element, as defined by the relevant rendering rules; for WebVTT, those are the rules for updating the display of WebVTT text tracks. WEBVTT

-

In privacy-preserving rendering, subtitles and captions are expected - to be rendered with default appearance that ignores any user preferences.

+

During read-back-allowed rendering, subtitles and captions are + expected to be rendered with default appearance that ignores any user + preferences.

When the user agent starts exposing a user interface for a video element, the user agent should run the rules for @@ -153315,8 +153316,8 @@ select { elements in their user interface, as discussed previously.

-

In privacy-preserving rendering, user agents are expected to act as - if the :visited pseudo-class does not +

During read-back-allowed rendering, user agents are expected to act + as if the :visited pseudo-class does not match.

@@ -153557,19 +153558,17 @@ if (s = prompt('What is your name?')) { -

Privacy-preserving rendering

+

Read-back-allowed rendering

-

In privacy-preserving rendering, any security- or privacy-sensitive +

During read-back-allowed rendering, any security- or privacy-sensitive information that isn't otherwise observable to author code are omitted or replaced with safe defaults. The detailed requirements are in the relevant sections above.

-

In privacy-preserving rendering, the user agent is expected to:

-

Summary

-

The following table summarizes how privacy-preserving rendering affects various +

The following table summarizes how read-back-allowed rendering affects various elements and features when they are rendered:

From f22bc53e7ad1aff5a82bfc6c8184bd9709e9322e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 16 Jun 2026 14:17:33 +0000 Subject: [PATCH 03/12] Move list over from HTML-in-Canvas PR --- source | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/source b/source index 4b1bd04eafb..33f70eadb11 100644 --- a/source +++ b/source @@ -4210,6 +4210,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • <length>
    • +
  • <url>
  • The 'em' unit
  • The 'ex' unit
  • The 'vw' unit
    • @@ -153564,6 +153565,50 @@ if (s = prompt('What is your name?')) { information that isn't otherwise observable to author code are omitted or replaced with safe defaults. The detailed requirements are in the relevant sections above.

    + +

    The following must not be exposed during read-back-allowed rendering:

    + +
    +
    All content +
    CORS-cross-origin content, including in embedded content (e.g., + iframe, img), canvas elements whose bitmap's origin-clean flag is set to false, CSS + <url> references (e.g., 'background-image', + 'border-image-source'), and SVG elements (e.g., use, pattern, feImage). +
    Non-default colors, themes, and preferences. +
    Non-default selection and find-in-page highlights. +
    Spelling and grammar markers. +
    Subpixel text rendering and antialiasing. + +
    Form-associated elements +
    Platform-specific appearance. +
    Pending autofill suggestions. + +
    Media elements +
    User preferences for caption and subtitle selection and appearance. + +
    a and area elements +
    Visited link information. +
    + +

    The above cases should all be merged into the appropriate part of the rendering + section.

    + +

    The following explicitly may be exposed during read-back-allowed rendering:

    + +
    +
    All content +
    Matching text from find-in-page. + +
    Form-associated elements +
    Default appearance that is the same on all platforms. + +
    iframe and frame elements +
    CORS-same-origin frames are not sensitive information, but + CORS-cross-origin content within them is.
    +
    +

    Summary

    From 45fa9dbde678cb192f21adb49cdd31f72c63259f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 14 Jul 2026 13:40:35 +0000 Subject: [PATCH 04/12] Disallow widget native appearance --- source | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/source b/source index 33f70eadb11..181a60644f6 100644 --- a/source +++ b/source @@ -151914,6 +151914,9 @@ input[type=image i][align=bottom i], object[align=bottom i] {
  • textarea
+

During read-back-allowed rendering, widgets must not + use native appearance.

+ @@ -153582,7 +153585,6 @@ if (s = prompt('What is your name?')) {
Subpixel text rendering and antialiasing.
Form-associated elements -
Platform-specific appearance.
Pending autofill suggestions.
Media elements From ed5d2be113a3bb4e7a145aac5bf703dbc7da2620 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 14 Jul 2026 13:52:28 +0000 Subject: [PATCH 05/12] Add widgets to summary table --- source | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/source b/source index 181a60644f6..9c8e6ad1f1c 100644 --- a/source +++ b/source @@ -153629,7 +153629,10 @@ if (s = prompt('What is your name?')) {
+
The :visited pseudo-class never matches.
Media elements - Subtitles and captionss use default appearance, ignoring any user preferences. + Subtitles and captions use default appearance, ignoring any user preferences. +
Widgets + Widgets use default appearance, not native appearance.
From 46d75b4d4734a473751ce3c2a4ab82fc0b5ec279 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 14 Jul 2026 13:55:04 +0000 Subject: [PATCH 06/12] Remove redundant media element and :visited requirements --- source | 6 ------ 1 file changed, 6 deletions(-) diff --git a/source b/source index 9c8e6ad1f1c..14a5888c739 100644 --- a/source +++ b/source @@ -153586,12 +153586,6 @@ if (s = prompt('What is your name?')) {
Form-associated elements
Pending autofill suggestions. - -
Media elements -
User preferences for caption and subtitle selection and appearance. - -
a and area elements -
Visited link information.

The above cases should all be merged into the appropriate part of the rendering From c899d3958ff6afae9b347d219354363e055b25c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 14 Jul 2026 15:02:26 +0000 Subject: [PATCH 07/12] Move more things into the rendering section subsections --- source | 76 ++++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 47 insertions(+), 29 deletions(-) diff --git a/source b/source index 14a5888c739..0afe7e08ee6 100644 --- a/source +++ b/source @@ -151574,6 +151574,10 @@ legend[align=right i] { the same natural dimensions as the element. Other canvas elements are expected to be treated as ordinary elements in the rendering model.

+

During read-back-allowed rendering, canvas elements whose bitmap's + origin-clean flag is set to false must not be + rendered.

+

An object element that represents an image, plugin, or its content navigable is expected to be treated as a replaced element. Other object elements are expected to be treated as @@ -151603,6 +151607,9 @@ legend[align=right i] { video element, as defined by the relevant rendering rules; for WebVTT, those are the rules for updating the display of WebVTT text tracks. WEBVTT

+

During read-back-allowed rendering, video elements whose media + data is CORS-cross-origin must not be rendered.

+

During read-back-allowed rendering, subtitles and captions are expected to be rendered with default appearance that ignores any user preferences.

@@ -151708,6 +151715,10 @@ iframe { border: 2px inset; } expected to provide access to the context menu that would have come up if the user interacted with the actual image.

+

During read-back-allowed rendering, img and input + elements whose current request's image data is + CORS-cross-origin must not be rendered.

+

All animated images with the same absolute URL and the same image data are @@ -153568,42 +153579,33 @@ if (s = prompt('What is your name?')) { information that isn't otherwise observable to author code are omitted or replaced with safe defaults. The detailed requirements are in the relevant sections above.

+

Requirements for read-back-allowed rendering are given throughout the Rendering section. Additionally, the following must not be rendered or + otherwise exposed during read-back-allowed rendering:

-

The following must not be exposed during read-back-allowed rendering:

- -
-
All content -
CORS-cross-origin content, including in embedded content (e.g., - iframe, img), canvas elements whose bitmap's origin-clean flag is set to false, CSS - <url> references (e.g., 'background-image', - 'border-image-source'), and SVG elements (e.g., use, pattern, feImage). -
Non-default colors, themes, and preferences. -
Non-default selection and find-in-page highlights. -
Spelling and grammar markers. -
Subpixel text rendering and antialiasing. +
    +
  • +

    Any CORS-cross-origin content in features defined by other specifications, + including but not limited to:

    -
    Form-associated elements -
    Pending autofill suggestions. -
+
    +

  • CSS <url> references (e.g., 'background-image', + 'border-image-source')

    • +

  • SVG elements (e.g., use, pattern, feImage)

    • +
+ -

The above cases should all be merged into the appropriate part of the rendering - section.

+

  • Non-default colors, themes, and preferences

    • -

    The following explicitly may be exposed during read-back-allowed rendering:

    +

  • Non-default selection and find-in-page highlights

    • -
    -
    All content -
    Matching text from find-in-page. +

  • Spelling and grammar markers

    • -
    Form-associated elements -
    Default appearance that is the same on all platforms. +

  • Subpixel text rendering and antialiasing

    • -
    iframe and frame elements -
    CORS-same-origin frames are not sensitive information, but - CORS-cross-origin content within them is.
    -
    +

  • Pending autofill suggestions

    • +

    Summary

    @@ -153621,6 +153623,9 @@ if (s = prompt('What is your name?')) { a and area elements The :visited pseudo-class never matches. + + Replaced elements + CORS-cross-origin content is not rendered. Media elements Subtitles and captions use default appearance, ignoring any user preferences. @@ -153629,6 +153634,19 @@ if (s = prompt('What is your name?')) { Widgets use default appearance, not native appearance. +

    The following following information does not have special requirements for + read-back-allowed rendering in this specification:

    + +
    +
    All content +
    Matching text from find-in-page + +
    iframe and frame elements +
    CORS-same-origin frames are not sensitive information, but + CORS-cross-origin content within them is.
    +
    + +

    Obsolete features

    From fc58e4ca73bd228daa58c0673a2f8e0f6c5bea42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Tue, 14 Jul 2026 15:33:21 +0000 Subject: [PATCH 08/12] Add a warning for authors --- source | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/source b/source index 0afe7e08ee6..504678e6901 100644 --- a/source +++ b/source @@ -151614,6 +151614,10 @@ legend[align=right i] { expected to be rendered with default appearance that ignores any user preferences.

    +

    This can affect the accessibility of video elements. Authors are + strongly discouraged from using video elements with subtitles or captions in context + that require read-back-allowed rendering.

    +

    When the user agent starts exposing a user interface for a video element, the user agent should run the rules for updating the text track rendering of each of the text From 8c0508bee294c3910d09eb801c5983e00a072549 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Wed, 9 Sep 2026 19:49:34 +0000 Subject: [PATCH 09/12] Don't render video controls, subtitles, or captions --- source | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/source b/source index 504678e6901..532eb4cc6f2 100644 --- a/source +++ b/source @@ -151610,13 +151610,12 @@ legend[align=right i] {

    During read-back-allowed rendering, video elements whose media data is CORS-cross-origin must not be rendered.

    -

    During read-back-allowed rendering, subtitles and captions are - expected to be rendered with default appearance that ignores any user - preferences.

    +

    During read-back-allowed rendering, controls, subtitles and captions must not be + rendered.

    -

    This can affect the accessibility of video elements. Authors are - strongly discouraged from using video elements with subtitles or captions in context - that require read-back-allowed rendering.

    +

    This affects the accessibility of video elements. Authors are + strongly discouraged from using video elements with controls, subtitles or captions + in contexts that require read-back-allowed rendering.

    When the user agent starts exposing a user interface for a video element, the user agent should run the rules for From a0a0c4cd51c7383f9791cc0315163d32bcc53821 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Wed, 9 Sep 2026 21:57:38 +0000 Subject: [PATCH 10/12] grammaroo: following following --- source | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source b/source index 532eb4cc6f2..e13d06edbfc 100644 --- a/source +++ b/source @@ -153637,7 +153637,7 @@ if (s = prompt('What is your name?')) { Widgets use default appearance, not native appearance. -

    The following following information does not have special requirements for +

    The following information does not have special requirements for read-back-allowed rendering in this specification:

    From 803b51ea2c56bce32987228ee3ff948baf2ea6eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Wed, 9 Sep 2026 21:59:25 +0000 Subject: [PATCH 11/12] Update summary on media elements --- source | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source b/source index e13d06edbfc..43c1480bafb 100644 --- a/source +++ b/source @@ -153631,7 +153631,7 @@ if (s = prompt('What is your name?')) { CORS-cross-origin content is not rendered. Media elements - Subtitles and captions use default appearance, ignoring any user preferences. + Controls, subtitles, and captions are not rendered. Widgets Widgets use default appearance, not native appearance. From 14b8837457e123bbea97f708ec912425e07aa8a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Sat, 12 Sep 2026 16:59:00 +0000 Subject: [PATCH 12/12] Move autofill into form controls section --- source | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/source b/source index 43c1480bafb..a5e7465d13a 100644 --- a/source +++ b/source @@ -151194,6 +151194,9 @@ input:not([type=image i]), textarea { box-sizing: border-box; }

  • The inner display type is always 'flow-root'.

    • +

    During read-back-allowed rendering, pending autofill suggestions must not be + rendered.

    +

    The hr element

    @@ -153606,8 +153609,6 @@ if (s = prompt('What is your name?')) {

  • Spelling and grammar markers

  • Subpixel text rendering and antialiasing

    • - -

  • Pending autofill suggestions

    • Summary

    @@ -153626,6 +153627,9 @@ if (s = prompt('What is your name?')) { a and area elements The :visited pseudo-class never matches. + + Form controls + Pending autofill suggestions are not rendered. Replaced elements CORS-cross-origin content is not rendered.