From c53fe9e04b2856967d1f2f716b99b0911251e521 Mon Sep 17 00:00:00 2001
From: Piotr Kotynia <[email protected]>
Date: Fri, 25 Sep 2026 00:46:00 -0700
Subject: [PATCH] [Autofill] Prevent textarea preview from leaking overflow geometry

When an Autofill preview is rendered in a <textarea>, the preview text
is placed into the placeholder <div> (::-internal-input-suggested) in
the UA shadow root. Unlike input::-internal-input-suggested, the
textarea preview rule did not clip overflow or constrain its maximum
size, allowing long preview text to trigger auto scrollbars (shrinking
clientWidth) and scrollable overflow (firing scroll events on
setScrollTop). This CL constrains textarea::-internal-input-suggested to
100% of the textarea content box with overflow: hidden in html.css so
preview text never increases the textarea's scrollable overflow.

Fixed: 513468106
Change-Id: Ic77677ef58433fa19cab3ce3d8cc1b88b906c3fb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8459483
Reviewed-by: Joey Arhar <[email protected]>
Commit-Queue: Piotr Kotynia <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1704654}
---
diff --git a/third_party/blink/renderer/core/html/resources/html.css b/third_party/blink/renderer/core/html/resources/html.css
index 5aec0fd4..617d343 100644
--- a/third_party/blink/renderer/core/html/resources/html.css
+++ b/third_party/blink/renderer/core/html/resources/html.css
@@ -616,6 +616,12 @@
     overflow: hidden;
 }
 
+textarea::-internal-input-suggested {
+    max-inline-size: 100%;
+    max-block-size: 100%;
+    overflow: hidden;
+}
+
 input::-internal-input-suggested,
 textarea::-internal-input-suggested {
     pointer-events: none !important;
diff --git a/third_party/blink/renderer/core/html/forms/html_text_area_element_test.cc b/third_party/blink/renderer/core/html/forms/html_text_area_element_test.cc
index 8b926be8..7bb445f9 100644
--- a/third_party/blink/renderer/core/html/forms/html_text_area_element_test.cc
+++ b/third_party/blink/renderer/core/html/forms/html_text_area_element_test.cc
@@ -732,6 +732,43 @@
             Color::FromRGB(0, 255, 0));
 }
 
+TEST_F(HTMLTextAreaElementTest, AutofillPreviewScrollSideChannelsLeak) {
+  LoadAhem();
+  SetBodyContent(R"HTML(
+    <textarea id="test" style="font: 10px Ahem; width: 80px; height: 20px; overflow: auto;"></textarea>
+  )HTML");
+  HTMLTextAreaElement& textarea = TestElement();
+  RunDocumentLifecycle();
+
+  const int baseline_client_width = textarea.clientWidth();
+  const int baseline_client_height = textarea.clientHeight();
+  const int baseline_offset_height = textarea.OffsetHeight();
+
+  // Set a long suggested value that wraps across many lines and would normally
+  // trigger a vertical scrollbar and scrollable overflow.
+  textarea.SetSuggestedValue(
+      "XXXXXXXXXX XXXXXXXXXX XXXXXXXXXX XXXXXXXXXX XXXXXXXXXX XXXXXXXXXX");
+  RunDocumentLifecycle();
+
+  // Neither clientWidth nor clientHeight should shrink due to an auto
+  // scrollbar during preview.
+  EXPECT_EQ(textarea.clientWidth(), baseline_client_width);
+  EXPECT_EQ(textarea.clientHeight(), baseline_client_height);
+  EXPECT_EQ(textarea.OffsetHeight(), baseline_offset_height);
+
+  // Programmatic scrolling via setScrollTop / setScrollLeft must not scroll the
+  // underlying PaintLayerScrollableArea during preview.
+  textarea.setScrollTop(50);
+  textarea.setScrollLeft(50);
+  RunDocumentLifecycle();
+
+  ASSERT_TRUE(textarea.GetLayoutBox());
+  if (const auto* scrollable_area =
+          textarea.GetLayoutBox()->GetScrollableArea()) {
+    EXPECT_EQ(scrollable_area->GetScrollOffset(), ScrollOffset());
+  }
+}
+
 TEST_F(HTMLTextAreaElementTest, GetTextInfoSyntheticBoldItalic) {
   LoadAhem();
 

diff --git a/third_party/blink/renderer/core/html/forms/html_text_area_element_test.cc b/third_party/blink/renderer/core/html/forms/html_text_area_element_test.cc
index 8b926be8..7bb445f9 100644
--- a/third_party/blink/renderer/core/html/forms/html_text_area_element_test.cc
+++ b/third_party/blink/renderer/core/html/forms/html_text_area_element_test.cc
@@ -732,6 +732,43 @@
             Color::FromRGB(0, 255, 0));
 }
 
+TEST_F(HTMLTextAreaElementTest, AutofillPreviewScrollSideChannelsLeak) {
+  LoadAhem();
+  SetBodyContent(R"HTML(
+    <textarea id="test" style="font: 10px Ahem; width: 80px; height: 20px; overflow: auto;"></textarea>
+  )HTML");
+  HTMLTextAreaElement& textarea = TestElement();
+  RunDocumentLifecycle();
+
+  const int baseline_client_width = textarea.clientWidth();
+  const int baseline_client_height = textarea.clientHeight();
+  const int baseline_offset_height = textarea.OffsetHeight();
+
+  // Set a long suggested value that wraps across many lines and would normally
+  // trigger a vertical scrollbar and scrollable overflow.
+  textarea.SetSuggestedValue(
+      "XXXXXXXXXX XXXXXXXXXX XXXXXXXXXX XXXXXXXXXX XXXXXXXXXX XXXXXXXXXX");
+  RunDocumentLifecycle();
+
+  // Neither clientWidth nor clientHeight should shrink due to an auto
+  // scrollbar during preview.
+  EXPECT_EQ(textarea.clientWidth(), baseline_client_width);
+  EXPECT_EQ(textarea.clientHeight(), baseline_client_height);
+  EXPECT_EQ(textarea.OffsetHeight(), baseline_offset_height);
+
+  // Programmatic scrolling via setScrollTop / setScrollLeft must not scroll the
+  // underlying PaintLayerScrollableArea during preview.
+  textarea.setScrollTop(50);
+  textarea.setScrollLeft(50);
+  RunDocumentLifecycle();
+
+  ASSERT_TRUE(textarea.GetLayoutBox());
+  if (const auto* scrollable_area =
+          textarea.GetLayoutBox()->GetScrollableArea()) {
+    EXPECT_EQ(scrollable_area->GetScrollOffset(), ScrollOffset());
+  }
+}
+
 TEST_F(HTMLTextAreaElementTest, GetTextInfoSyntheticBoldItalic) {
   LoadAhem();