CSS Scrollbars 2021-08-29 > 2021-09-30

[frivoal]

In the issue title above add the document name followed by the date of this request, then the date of your proposed deadline for comments.

• name of spec to be reviewed: CSS Scrollbars Level 1

• URL of spec: https://www.w3.org/TR/css-scrollbars-1/

• Does your document have an in-line Security Considerations section, separate from Privacy Considerations? https://www.w3.org/TR/css-scrollbars-1/#security-considerations and https://www.w3.org/TR/css-scrollbars-1/#privacy-considerations

• What and when is your next expected transition? We're planing to go to CR soon, for a loosely defined value of soon: as soon as HR completes, unless something unexpected shows up.

• What has changed since any previous review? I am unsure that there was a previous review for privacy

• Please point to the results of your own self-review: https://www.w3.org/TR/css-scrollbars-1/#security-privacy-considerations

• Where and how to file issues arising? https://github.com/w3c/csswg-drafts/labels/css-scrollbars-1

• Pointer to any explainer for the spec? https://github.com/felipeerias/css-scrollbars-explainer

Other comments:

[jonathanKingston]

The whole specification seems fine to me based upon:

• CORS frames can't access the style property so there's no way to steal entropy across frames etc.
• There isn't any persistence to the property.
• It seems unlikely this could be used to assist in spoofing the user, but theme-color would have the same concerns with a larger surface area.

[sandandsnow]

This review was discussed during the PING call on 2 September 2021. Closing this issue as the review is complete. Note: no privacy issues identified in the review.