Privacy Preserving HTML and SVG in Canvas

[schenney-chromium]

Logistics

• Date & Time: Wednesday 4th June at 12:00 CEST (local time)
• URL: https://meet.jit.si/WEH2025-Privacy
• Notes: https://hackmd.io/@rego/WEH2025-Privacy/edit
• Room: JS

Facilitator(s)

@schenney-chromium

Summary

Browsers support SVG-as-Image in a canvas element, and there is a proposal under active development to allow HTML content to be placed into the canvas. Some use cases require the canvas remain untainted to support read-back of the canvas content. How can we achieve this in a privacy preserving manner?

Existing SVG cases allow <foreignObject> content in the canvas without tainting relying on the fact that SVG used as an image has scripting disabled and cannot load external resources. However, this still leaks personal information in the form of theme information (scrollbars, some colors, etc) and accessibility preferences (various CSS prefers-color-scheme and the like).

How can we improve this situation? What is the most effective way to implement a more privacy-preserving HTML and SVG in Canvas?

Type

Onsite

Other comments

No response

[mrego]

We're proposing Wednesday 4th June at 16:30 CEST (local time) for this session.

If that's a problem, please let us know to try to find other slot in the scheduling.

[mrego]

Would it be fine to move this to Wednesday 4th June at 12:00 CEST (local time) ?

[schenney-chromium]

No problem at all for me.

[schenney-chromium]

Summary of the key discussion points:

• Went through the various examples of HTML and CSS leaking OS settings
• It was pointed out that CSS @media rules can already provide fingerprinting outside of canvas because the CSS rules may include layout-affecting properties (such as font size) and these can be observed through JS queries on bonding boxes and the like. There was some consensus that trying to improve this situation for standard DOM would be useful, and any improvements would automatically improve HTML in Canvas situations. Meanwhile, there is little benefit to having such properties lead to canvas tainting. TODO: As use counters or some other metrics to try to figure out what properties appear in such rules.
• The CSS and HTML specs (all of them) need to include fingerprinting implications for their features. HTML has such information already, but CSS largely does not. TODO: Audit CSS specs and identify improvements to fingerprinting information. Update specs as required.
• To address SVG-as-Image and HTML-in-Canvas tainting, maintain a bitmask on the document (or per canvas element or SVG foreign object) and record which fingerprinting features are encountered during parse time. Use this mask when determining if the canvas should be tainted. This has the following advantages:
  • The cost is minimal in terms of memory and time, so does not itself introduce timing-related attacks.
  • The decision at draw time is simple and fast, also avoiding timing attacks.
  • It scales to larger document sizes
  • It is minimally intrusive to the rest of the engine.
  • At parse time the raw information is available (particularly for CSS)

[schenney-chromium]

Talk slides.

Reducing_Canvas_Fingerprinting_Due_To_SVG_and_HTML_Hackfest2025.pdf

[mrego]

Are there any other notes from this session? If not I guess we can close this issue.

[schenney-chromium]

I don't think anyone took notes. I updated the notes I had previously written up on the topic but I don't want to share them yet. They will eventually go up on the Explainer site for HTML-in-Canvas.