You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The <iframe> element always fires a load event, protecting from the parent the information whether the child document loaded correctly.
However, the <object> element fires either load or error, depending on whether the child document loaded correctly. Should that behave like <iframe> instead, so that the information does not leak?
On top of that, <object> supports fallback rendering of its inlined content in case embedding the object data failed. That can also leak the same information.
The
<iframe>
element always fires a load event, protecting from the parent the information whether the child document loaded correctly.However, the
<object>
element fires either load or error, depending on whether the child document loaded correctly. Should that behave like<iframe>
instead, so that the information does not leak?On top of that,
<object>
supports fallback rendering of its inlined content in case embedding the object data failed. That can also leak the same information.Originally posted by @antosart in whatwg/html#7327
The text was updated successfully, but these errors were encountered: