Closed Bug 1525898 Opened 5 years ago Closed 5 years ago

Cursor drawn via CSS should not overlay chrome (or escape viewport)

Categories

(Core :: CSS Parsing and Computation, enhancement)

Product:
Core
Component:
CSS Parsing and Computation
Type:
enhancement
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1445844

People

(Reporter: freddy, Unassigned)

Details

(Keywords: sec-low)

One can paint a cursor image that is mostly transparent and makes the cursor appear some place else than it actually is. This can fool people into thinking they are interacting with chrome elements, when they are in fact still pointing to content.

I suggest that we fix this by not allowing cursors overlaying chrome elements.

Demos of the technique can be found at https://jameshfisher.github.io/cursory-hack/ and http://benjaminbenben.com/cursory-hack/

If only I wouldn't have fixed this yesterday.

Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.