PatchGap
Chrome · Paint › Blink>Paint

CVE-2026-106336

Info Disclosure in Paint (Blink>Paint)
Medium chrome Info Disclosure 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactObservable discrepancy in Paint
DescriptionObservable discrepancy in Paint
ComponentPaint
Sub-componentBlink>Paint
Bug ClassInfo Disclosure
Tracker522722456
Fix commit52d40943db06 (chromium/src) +20/-18
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-06

Files Changed

  • third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
  • third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
  • third_party/blink/web_tests/platform/win11-arm64/paint/markers/first-letter-expected.png
  • third_party/blink/web_tests/platform/win10/paint/markers/inline_spelling_markers-expected.png
  • third_party/blink/web_tests/platform/win11-arm64/paint/markers/inline_spelling_markers-expected.png
  • third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
  • third_party/blink/renderer/core/paint/decoration_line_painter.cc
  • third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
  • third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
  • third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-expected.png
  • third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
  • third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
  • third_party/blink/web_tests/platform/linux/fast/ruby/text-decoration-expected.png
  • third_party/blink/web_tests/platform/win11-arm64/fast/canvas/fillText-emoji-expected.png
  • third_party/blink/web_tests/platform/win/paint/markers/first-letter-expected.png
  • third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
  • third_party/blink/web_tests/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-expected.png
  • third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
  • third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
  • third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
  • third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-simple-underlines-expected.png
  • third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-hidpi-expected.png
  • third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
  • third_party/blink/web_tests/platform/win/fast/ruby/text-decoration-expected.png
  • third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
  • third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-hidpi-expected.png
  • third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
  • third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
  • third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
  • third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
  • third_party/blink/web_tests/platform/win11-arm64/paint/markers/grammar-markers-expected.png
  • third_party/blink/web_tests/platform/linux/paint/markers/inline_spelling_markers-expected.png
  • third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
  • third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
  • third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
  • third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-expected.png
  • third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-not-propagated-by-out-of-flow-expected.png
  • third_party/blink/web_tests/platform/linux/paint/markers/first-letter-expected.png
  • third_party/blink/web_tests/platform/mac/fast/ruby/text-decoration-expected.png
  • third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-expected.png
  • third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png

Patch

view commit
From 52d40943db06c51de84abf93579a584e3da8edbb Mon Sep 17 00:00:00 2001
From: Philip Rogers <[email protected]>
Date: Mon, 14 Sep 2026 11:45:02 -0700
Subject: [PATCH] Make wavy decoration tile cache independent of color

Decoration color can depend on visited link information, and the
decoration tile cache can be used in timing attacks to detect visited
link information. This patch makes the cache in WavyGeometry
independent of color, instead applying the color via a color filter.

Fixed: 522722456
Change-Id: I29008b061e5f67b7b8cf5f604da646d7338003be
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8400055
Reviewed-by: Stephen Chenney <[email protected]>
Commit-Queue: Philip Rogers <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1697389}
---
diff --git a/third_party/blink/renderer/core/paint/decoration_line_painter.cc b/third_party/blink/renderer/core/paint/decoration_line_painter.cc
index 9a4810d3..de3e71c 100644
--- a/third_party/blink/renderer/core/paint/decoration_line_painter.cc
+++ b/third_party/blink/renderer/core/paint/decoration_line_painter.cc
@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/paint/decoration_line_painter.h"
 
+#include "cc/paint/color_filter.h"
 #include "cc/paint/paint_flags.h"
 #include "cc/paint/paint_record.h"
 #include "third_party/blink/renderer/platform/geometry/path_builder.h"
@@ -24,7 +25,7 @@
 
 // True when `flags` describes a flat solid-color fill (no shader, no
 // color/image filter, no draw looper, no path effect, default blend mode)
-// that the cached per-color tile-shader path can render faithfully. SVG
+// that the cached tile-shader path can render faithfully. SVG
 // fill setup may attach a `DrawLooper` (text-shadow) or `ColorFilter`
 // (color-interpolation: linearRGB on a mask) on top of a non-shader paint;
 // guarding against those keeps such effects on the slower full-width
@@ -230,7 +231,7 @@
 
   gfx::RectF PaintRect(const DecorationGeometry& geometry) const;
 
-  const cc::PaintRecord& TileRecord(const Color& color) const;
+  const cc::PaintRecord& TileRecord() const;
   gfx::RectF TileRect() const {
     // The wavy tile rect is the same size as the wavy pattern rect but at
     // origin (0,0).
@@ -275,7 +276,6 @@
   gfx::RectF bounds_;
   float thickness_;
   mutable cc::PaintRecord tile_record_;
-  mutable Color tile_record_color_;
 };
 
 gfx::RectF WavyGeometry::PaintRect(const DecorationGeometry& geometry) const {
@@ -303,11 +303,13 @@
          gfx::Vector2dF{bounds_.x(), geometry.wavy_offset};
 }
 
-const cc::PaintRecord& WavyGeometry::TileRecord(const Color& color) const {
-  if (tile_record_color_ != color || tile_record_.empty()) {
+const cc::PaintRecord& WavyGeometry::TileRecord() const {
+  if (tile_record_.empty()) {
+    // Record the tile as an opaque-black mask; the decoration color is
+    // applied at draw time via a color filter on the outer paint flags.
     cc::PaintFlags flags;
     flags.setAntiAlias(true);
-    flags.setColor(color.Rgb());
+    flags.setColor(SK_ColorBLACK);
     flags.setStyle(cc::PaintFlags::kStroke_Style);
     flags.setStrokeWidth(thickness_);
 
@@ -317,7 +319,6 @@
     canvas->translate(-bounds_.x(), -bounds_.y());
     canvas->drawPath(path_.GetSkPath(), flags);
     tile_record_ = recorder.finishRecordingAsPicture();
-    tile_record_color_ = color;
   }
   return tile_record_;
 }
@@ -492,31 +493,32 @@
   // SVG fill pass with a paint server / shadow / color filter / blend mode:
   // full-width outline so the paint server applies continuously and any
   // effects attached to the paint flags (looper, color filter, ...) are
-  // honored. Solid-color fills fall through to the cached per-color tile
-  // path below.
+  // honored. Solid-color fills fall through to the cached tile path below.
   if (paint_flags && !IsSimpleSolidFillPaint(*paint_flags)) {
     wavy_geometry.PaintFill(context_, geometry, *paint_flags, auto_dark_mode);
     return;
   }
 
+  // Non-SVG (HTML) callers and solid-color SVG fills: cached tile shader.
+  // The tile is recorded as an opaque-black mask that's shared across all
+  // decorations with the same wave geometry; the color is applied below via a
+  // color filter so the cached record never needs to be rebuilt when colors
+  // change.
+  const gfx::RectF paint_rect = wavy_geometry.PaintRect(geometry);
+  const gfx::RectF tile_rect = wavy_geometry.TileRect();
   // Per the SVG text-decoration spec [1], the decoration paint is the text's
   // fill -- not `text-decoration-color` -- so for solid SVG fills the cached
   // tile path uses the paint's own color.
   // [1] https://svgwg.org/svg2-draft/text.html#TextDecorationProperties
-  const Color color = paint_flags
-                          ? Color::FromSkColor4f(paint_flags->getColor4f())
-                          : decoration_color;
-
-  // Non-SVG (HTML) callers and solid-color SVG fills: cached per-color tile
-  // shader.
-  const gfx::RectF paint_rect = wavy_geometry.PaintRect(geometry);
-  const gfx::RectF tile_rect = wavy_geometry.TileRect();
+  const SkColor4f color =
+      paint_flags ? paint_flags->getColor4f() : decoration_color.toSkColor4f();
 
   cc::PaintFlags flags;
   flags.setAntiAlias(true);
   flags.setShader(PaintShader::MakePaintRecord(
-      wavy_geometry.TileRecord(color), gfx::RectFToSkRect(tile_rect),
+      wavy_geometry.TileRecord(), gfx::RectFToSkRect(tile_rect),
       SkTileMode::kRepeat, SkTileMode::kDecal, nullptr));
+  flags.setColorFilter(cc::ColorFilter::MakeBlend(color, SkBlendMode::kSrcIn));
 
   GraphicsContextStateSaver state_saver(context_);
   context_.Translate(paint_rect.x(), paint_rect.y());
diff --git a/third_party/blink/web_tests/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-expected.png b/third_party/blink/web_tests/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-expected.png
index f4decbf7..2e1d8663 100644
--- a/third_party/blink/web_tests/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-expected.png
+++ b/third_party/blink/web_tests/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
index 3af2234f..40d1f7b 100644
--- a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index 50ef5f49..b17ee858 100644
--- a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
index 834e9ec..d2de97c5 100644
--- a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index dee7b72..1ee0d559 100644
--- a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/ruby/text-decoration-expected.png b/third_party/blink/web_tests/platform/linux/fast/ruby/text-decoration-expected.png
index d6cb1f94..b689c5d 100644
--- a/third_party/blink/web_tests/platform/linux/fast/ruby/text-decoration-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/ruby/text-decoration-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/first-letter-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/first-letter-expected.png
index 88e24ef1..d834eb8 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/first-letter-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/first-letter-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-expected.png
index d5a07d5e..2e1a862 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-hidpi-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-hidpi-expected.png
index 00be6815..158eb90 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-hidpi-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
index 68358d80..c76e6462 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
index 68358d80..c76e6462 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/inline_spelling_markers-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/inline_spelling_markers-expected.png
index 42987c63..562b04b1 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/inline_spelling_markers-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/inline_spelling_markers-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
deleted file mode 100644
index 59fec24..0000000
--- a/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index 96a72e6..1660c3f 100644
--- a/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index d7ef14077..0ee9f3b 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
index 3925ed8..83cd7cf 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-not-propagated-by-out-of-flow-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-not-propagated-by-out-of-flow-expected.png
index 326521ab..e3d2d47 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-not-propagated-by-out-of-flow-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-not-propagated-by-out-of-flow-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-simple-underlines-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-simple-underlines-expected.png
index 7f8ed78c..b53e336 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-simple-underlines-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-simple-underlines-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index ce7f76f..36c4061 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/ruby/text-decoration-expected.png b/third_party/blink/web_tests/platform/mac/fast/ruby/text-decoration-expected.png
index 35962a2..31c80c2 100644
--- a/third_party/blink/web_tests/platform/mac/fast/ruby/text-decoration-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/ruby/text-decoration-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index dfd4a6ac..94e8264c 100644
--- a/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
index a8234ab..53126c5 100644
--- a/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ b/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/fast/ruby/text-decoration-expected.png b/third_party/blink/web_tests/platform/win/fast/ruby/text-decoration-expected.png
index f315793..93739ff6 100644
--- a/third_party/blink/web_tests/platform/win/fast/ruby/text-decoration-expected.png
+++ b/third_party/blink/web_tests/platform/win/fast/ruby/text-decoration-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/paint/markers/first-letter-expected.png b/third_party/blink/web_tests/platform/win/paint/markers/first-letter-expected.png
index 36758b7..bd89b9a 100644
--- a/third_party/blink/web_tests/platform/win/paint/markers/first-letter-expected.png
+++ b/third_party/blink/web_tests/platform/win/paint/markers/first-letter-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-expected.png b/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-expected.png
index 4418381f..5e36c5d 100644
--- a/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-expected.png
+++ b/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-hidpi-expected.png b/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-hidpi-expected.png
index d0b2e45e..f5a3dd6 100644
--- a/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-hidpi-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
index 23e0f0e..b17f340a 100644
--- a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
+++ b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
deleted file mode 100644
index b50eb19..0000000
--- a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index a6f8409..891754a 100644
--- a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index ebcfcd5..8e4b4440 100644
--- a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-composited-expected.png b/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
new file mode 100644
index 0000000..92e199b1
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-expected.png b/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-expected.png
new file mode 100644
index 0000000..92e199b1
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/paint/markers/inline_spelling_markers-expected.png b/third_party/blink/web_tests/platform/win10/paint/markers/inline_spelling_markers-expected.png
new file mode 100644
index 0000000..999e989
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win10/paint/markers/inline_spelling_markers-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/fast/canvas/fillText-emoji-expected.png b/third_party/blink/web_tests/platform/win11-arm64/fast/canvas/fillText-emoji-expected.png
index 7759ab91..d71f0ca 100644
--- a/third_party/blink/web_tests/platform/win11-arm64/fast/canvas/fillText-emoji-expected.png
+++ b/third_party/blink/web_tests/platform/win11-arm64/fast/canvas/fillText-emoji-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png b/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
deleted file mode 100644
index b50eb19..0000000
--- a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
deleted file mode 100644
index f4c9d6c..0000000
--- a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index 0f02147..38e98232 100644
--- a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/first-letter-expected.png b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/first-letter-expected.png
index ffe6064..113e274 100644
--- a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/first-letter-expected.png
+++ b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/first-letter-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/grammar-markers-expected.png b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/grammar-markers-expected.png
deleted file mode 100644
index fb064b0..0000000
--- a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/grammar-markers-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/inline_spelling_markers-expected.png b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/inline_spelling_markers-expected.png
index 28e67bd..999e989 100644
--- a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/inline_spelling_markers-expected.png
+++ b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/inline_spelling_markers-expected.png
Binary files differ
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/third_party/blink/web_tests/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-expected.png b/third_party/blink/web_tests/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-expected.png
index f4decbf7..2e1d8663 100644
--- a/third_party/blink/web_tests/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-expected.png
+++ b/third_party/blink/web_tests/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
index 3af2234f..40d1f7b 100644
--- a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index 50ef5f49..b17ee858 100644
--- a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
index 834e9ec..d2de97c5 100644
--- a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index dee7b72..1ee0d559 100644
--- a/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/fast/ruby/text-decoration-expected.png b/third_party/blink/web_tests/platform/linux/fast/ruby/text-decoration-expected.png
index d6cb1f94..b689c5d 100644
--- a/third_party/blink/web_tests/platform/linux/fast/ruby/text-decoration-expected.png
+++ b/third_party/blink/web_tests/platform/linux/fast/ruby/text-decoration-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/first-letter-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/first-letter-expected.png
index 88e24ef1..d834eb8 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/first-letter-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/first-letter-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-expected.png
index d5a07d5e..2e1a862 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-hidpi-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-hidpi-expected.png
index 00be6815..158eb90 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/grammar-markers-hidpi-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
index 68358d80..c76e6462 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
index 68358d80..c76e6462 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/linux/paint/markers/inline_spelling_markers-expected.png b/third_party/blink/web_tests/platform/linux/paint/markers/inline_spelling_markers-expected.png
index 42987c63..562b04b1 100644
--- a/third_party/blink/web_tests/platform/linux/paint/markers/inline_spelling_markers-expected.png
+++ b/third_party/blink/web_tests/platform/linux/paint/markers/inline_spelling_markers-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
deleted file mode 100644
index 59fec24..0000000
--- a/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index 96a72e6..1660c3f 100644
--- a/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/mac-mac26-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index d7ef14077..0ee9f3b 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
index 3925ed8..83cd7cf 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-not-propagated-by-out-of-flow-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-not-propagated-by-out-of-flow-expected.png
index 326521ab..e3d2d47 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-not-propagated-by-out-of-flow-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-not-propagated-by-out-of-flow-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-simple-underlines-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-simple-underlines-expected.png
index 7f8ed78c..b53e336 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-simple-underlines-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-simple-underlines-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index ce7f76f..36c4061 100644
--- a/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/fast/ruby/text-decoration-expected.png b/third_party/blink/web_tests/platform/mac/fast/ruby/text-decoration-expected.png
index 35962a2..31c80c2 100644
--- a/third_party/blink/web_tests/platform/mac/fast/ruby/text-decoration-expected.png
+++ b/third_party/blink/web_tests/platform/mac/fast/ruby/text-decoration-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index dfd4a6ac..94e8264c 100644
--- a/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
index a8234ab..53126c5 100644
--- a/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ b/third_party/blink/web_tests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/fast/ruby/text-decoration-expected.png b/third_party/blink/web_tests/platform/win/fast/ruby/text-decoration-expected.png
index f315793..93739ff6 100644
--- a/third_party/blink/web_tests/platform/win/fast/ruby/text-decoration-expected.png
+++ b/third_party/blink/web_tests/platform/win/fast/ruby/text-decoration-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/paint/markers/first-letter-expected.png b/third_party/blink/web_tests/platform/win/paint/markers/first-letter-expected.png
index 36758b7..bd89b9a 100644
--- a/third_party/blink/web_tests/platform/win/paint/markers/first-letter-expected.png
+++ b/third_party/blink/web_tests/platform/win/paint/markers/first-letter-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-expected.png b/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-expected.png
index 4418381f..5e36c5d 100644
--- a/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-expected.png
+++ b/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-hidpi-expected.png b/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-hidpi-expected.png
index d0b2e45e..f5a3dd6 100644
--- a/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/win/paint/markers/grammar-markers-hidpi-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
index 23e0f0e..b17f340a 100644
--- a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
+++ b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-line-grammar-error-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
deleted file mode 100644
index b50eb19..0000000
--- a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index a6f8409..891754a 100644
--- a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index ebcfcd5..8e4b4440 100644
--- a/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/win10/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-composited-expected.png b/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
new file mode 100644
index 0000000..92e199b1
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-expected.png b/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-expected.png
new file mode 100644
index 0000000..92e199b1
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win10/paint/markers/inline-spelling-markers-hidpi-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win10/paint/markers/inline_spelling_markers-expected.png b/third_party/blink/web_tests/platform/win10/paint/markers/inline_spelling_markers-expected.png
new file mode 100644
index 0000000..999e989
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win10/paint/markers/inline_spelling_markers-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/fast/canvas/fillText-emoji-expected.png b/third_party/blink/web_tests/platform/win11-arm64/fast/canvas/fillText-emoji-expected.png
index 7759ab91..d71f0ca 100644
--- a/third_party/blink/web_tests/platform/win11-arm64/fast/canvas/fillText-emoji-expected.png
+++ b/third_party/blink/web_tests/platform/win11-arm64/fast/canvas/fillText-emoji-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png b/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
deleted file mode 100644
index b50eb19..0000000
--- a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-skip-ink-all-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png b/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
deleted file mode 100644
index f4c9d6c..0000000
--- a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-links-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png b/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
index 0f02147..38e98232 100644
--- a/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
+++ b/third_party/blink/web_tests/platform/win11-arm64/fast/css3-text/css3-text-decoration/text-decoration-style-wavy-font-size-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/first-letter-expected.png b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/first-letter-expected.png
index ffe6064..113e274 100644
--- a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/first-letter-expected.png
+++ b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/first-letter-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/grammar-markers-expected.png b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/grammar-markers-expected.png
deleted file mode 100644
index fb064b0..0000000
--- a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/grammar-markers-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/inline_spelling_markers-expected.png b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/inline_spelling_markers-expected.png
index 28e67bd..999e989 100644
--- a/third_party/blink/web_tests/platform/win11-arm64/paint/markers/inline_spelling_markers-expected.png
+++ b/third_party/blink/web_tests/platform/win11-arm64/paint/markers/inline_spelling_markers-expected.png
Binary files differ
Loading diff…

Original Bug Report

reported by [email protected]

Cross-origin history leak via wavy text decoration cache thrashing

Flapjack, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A timing side-channel exists in the rendering of wavy text decorations, allowing an attacker to determine if a cross-origin URL has been visited. This is caused by a shared, single-entry cache that thrashes when interleaved links with identical geometry but alternating colors are painted, resulting in measurable frame rendering delays.

Affected files:

  • third_party/blink/renderer/core/paint/decoration_line_painter.cc

Estimated timestamp from git blame: 2025-06-25

Description

A potential timing side-channel vulnerability exists in Blink’s rendering path for wavy text decorations (text-decoration-style: wavy). This allows an attacker to bypass standard :visited history protections and leak whether a user has visited a specific cross-origin URL.

The issue stems from the caching implementation in third_party/blink/renderer/core/paint/decoration_line_painter.cc:

  1. Shared Static Cache: The function GetWavyGeometry utilizes a DEFINE_STATIC_LOCAL single-entry cache (wavy_cache) keyed by WavyParams. WavyParams includes geometry data but excludes the decoration color. Consequently, all elements in the renderer process with identical wavy geometry share the same WavyGeometry instance.
  2. Color-Sensitive Tile Cache: Inside the shared WavyGeometry class, TileRecord(const Color& color) maintains its own single-entry mutable cache for the cc::PaintRecord (tile_record_), keyed by tile_record_color_.
  3. Cache Thrashing Path: If TileRecord is called sequentially with alternating colors, the single-entry cache continuously misses. On every miss, it takes a slow path: invoking a PaintRecorder, drawing the path (triggering expensive Skia geometric analysis), and finishing the record (forcing memory allocations and memcpy operations within cc::PaintOpBuffer).

Potential Exploitation Steps

While our automated tooling cannot run a live Proof-of-Concept, an attacker would likely follow these steps to trigger the vulnerability from malicious web content:

  1. Create a webpage with thousands of interleaved <a> elements.
  2. Configure the href attributes to alternate between a ‘Target’ URL (the history state to be leaked) and a ‘Probe’ URL (a known unvisited URL).
  3. Apply CSS to ensure all links have identical wavy geometry (e.g., text-decoration: underline wavy; text-decoration-thickness: 2px; font-size: 16px;). This guarantees they all hit the shared WavyGeometry instance.
  4. Apply CSS rules that map visited and unvisited states to different colors (e.g., a:link { text-decoration-color: red; } a:visited { text-decoration-color: blue; }).
  5. Use JavaScript and requestAnimationFrame to continuously force repaints and measure the frame delta time.
  6. Observation:
    • If the Target URL is unvisited, all links share the same color (e.g., Red). The TileRecord cache hits after the first element, resulting in fast frame rendering.
    • If the Target URL is visited, the links alternate colors (Blue, Red, Blue, Red…). This causes continuous cache thrashing on the shared WavyGeometry instance, forcing expensive re-recording for every element and significantly increasing the frame render time.
    • By measuring this timing delta, the attacker reliably infers the visited state of the cross-origin Target URL.

Suggested Fix

To prevent this side-channel, the rendering of the wavy line path should be decoupled from the decoration color during the recording phase:

  • Modify WavyGeometry::TileRecord to record the path using a neutral mask color (e.g., solid black or white) and remove Color from its cache key.
  • During the paint phase in PaintWavyTextDecoration, apply the actual decoration_color to the cached neutral tile record using a tinting mechanism, such as a cc::ColorFilter applied to the PaintFlags, before drawing the rect.

Evaluated with Chrome root at commit: 2155cb00003ec35716a76ed3246eae995f87b7ff

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

  • If you are familiar with the severity guidelines, you may adjust the severity.
  • If this is a false positive, and there’s no work to be done, please close as WAI.
  • If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.

View on issue tracker
On This Page