Chrome · Fonts
CVE-2026-91714
Info Disclosure in Fonts
Overview
Medium
Severity
5.3
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- Autofill preview pseudo-elements
::-internal-input-suggested(oninput/textarea) and::-internal-select-autofill-preview-text(onselect) are internal Blink pseudo-elements that render the browser-supplied preview of a suggested/autofilled value before the user commits it.- `font: -webkit-small-control`
- a CSS system-font shorthand that Blink expands to a concrete platform family name (e.g.
Arialon Windows/Linux,Helveticaon macOS) rather than a generic family. - Author `@font-face` with `unicode-range`
- a page-declared font face bound to a family name and restricted to a range of code points; the browser only fetches its
url()resource when text using that family actually contains a code point inside the range. - Generic font family
- families like
sans-serifthat resolve directly to a platform font and are never matched against author@font-facedeclarations (FontDescription::Family::FamilyIsGeneric()returns true).
Root Cause Analysis
The user-agent stylesheet styled the autofill preview pseudo-elements with font: -webkit-small-control !important, and this system font resolves to a concrete family name such as Arial. Because a concrete family name participates in normal font matching, an author-declared @font-face for that same name (with a narrow unicode-range) could be consulted when rendering the privileged preview text. That gave the page a side channel: the browser fetches the author font’s url() only if the preview string contains a code point in the declared range, so observing whether the request fires discloses characters of the previewed (autofilled) value. The invariant that browser-generated preview content must not be observable by the page was therefore violated.
The fix appends font-family: sans-serif !important (guarded by the new AutofillPreviewGenericFontFamily feature) after the shorthand, forcing the family to a generic one; generic families are never matched against author @font-face, so no author face can be consulted and the oracle disappears. The regression test asserts Family().FamilyIsGeneric() on the preview placeholder and that the probe faces stay unloaded.
Key insight
The single mistake was pinning the preview font to a concrete platform family, which is subject to author
@font-face matching; pinning a generic family (sans-serif) instead removes the preview text from the author font-matching path entirely, closing the disclosure channel.Attack Path
- Declare a probing font face
The page registers an author
@font-facefor the concrete family the preview uses (e.g.Arial/Helvetica) with a narrowunicode-rangecovering candidate characters, whoseurl()points to an attacker-observable resource. - Trigger an autofill preview
The page presents a form control so the browser renders suggested/autofilled preview text through
::-internal-input-suggestedor::-internal-select-autofill-preview-text, which pre-patch resolved to that concrete family. - Observe the conditional fetch
Because the concrete family matched the author face, the browser requests the font
url()only when the preview text contains a code point inside the declared range, signaling a character match to the attacker. - Reconstruct the previewed value (inferred)
By repeating with progressively narrowed single-character
unicode-rangefaces, the attacker can extrapolate which characters the preview contains and reconstruct the sensitive autofilled value; the patch demonstrates the single-face oracle but not full string recovery.
Impact Assessment
An attacking page gains an observable discrepancy — a font-load oracle — that lets it detect characters of browser-generated autofill preview text (potentially sensitive suggested values) from within the renderer/page context, before the user commits the value. The precondition is that the user has an autofill suggestion previewed for a control on the attacker’s page, and the attacker can observe the resulting font resource request. The advisory classifies this as a
LogicError / “Observable discrepancy in Fonts”; reconstruction of a complete sensitive value and any broader escalation is (inferred) and not demonstrated by the patch, and there is no in-the-wild-exploitation claim in the provided advisory.Changed Functions
| Function | Change | Notes |
|---|---|---|
TEST_Fthird_party/blink/renderer/core/html/forms/html_input_element_test.cc |
modified | |
forthird_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html |
modified |
Files Changed
third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.htmlthird_party/blink/renderer/platform/runtime_enabled_features.json5third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.htmlthird_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.htmlthird_party/blink/renderer/core/html/resources/html.cssthird_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.htmlthird_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.htmlthird_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.htmlthird_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.htmlthird_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.htmlthird_party/blink/renderer/core/html/forms/html_input_element_test.cc
Audit Directions
- System-font resolution to concrete familiesAudit other UA-stylesheet rules that use
font: -webkit-small-controlor similar system fonts on browser-privileged/internal pseudo-elements, since these resolve to concrete family names subject to author@font-facematching. - Privileged text exposed to author font matchingLook for any browser-generated or privileged text (placeholders, previews, spellcheck, generated content) rendered with a concrete family, where an author
@font-faceplusunicode-rangecould act as a per-character load oracle. - `unicode-range` conditional-fetch side channelsReview features where text content the page should not read is rendered in a way that lets a
unicode-range-restricted author font’s conditional network fetch reveal character presence.
Patch
From 6d75158e8ce3027e3557ec04808067a0ad39b30d Mon Sep 17 00:00:00 2001 From: Dileep Maurya <[email protected]> Date: Wed, 24 Jun 2026 10:58:58 -0700 Subject: [PATCH] Pin suggested-value pseudo elements to a generic font family `font: -webkit-small-control` resolves font-family to a concrete platform name (e.g. "Arial"), so the !important rule on `::-internal-input-suggested` and `::-internal-select-autofill-preview-text` could still pick up an author @font-face declared for that name. Append `font-family: sans-serif !important` after the shorthand so the preview text always resolves to a generic family, matching the existing `textarea::-internal-input-suggested` rule. Bug: 517710554 Change-Id: I063833950480d20453491d5a07dea842c0b061d1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7930489 Reviewed-by: Joey Arhar <[email protected]> Commit-Queue: Dileep Maurya <[email protected]> Reviewed-by: Kevin Babbitt <[email protected]> Cr-Commit-Position: refs/heads/main@{#1651835} --- diff --git a/third_party/blink/renderer/core/html/resources/html.css b/third_party/blink/renderer/core/html/resources/html.css index a6baa41b1..829b476f 100644 --- a/third_party/blink/renderer/core/html/resources/html.css +++ b/third_party/blink/renderer/core/html/resources/html.css @@ -637,6 +637,13 @@ input::-internal-input-suggested, textarea::-internal-input-suggested { font: -webkit-small-control !important; + /* font: -webkit-small-control resolves to Arial on every platform. Ideally + we'd keep Arial, but a concrete family is matched against author + @font-face, so a single-character unicode-range could disclose the + preview text; a generic family avoids that lookup. crbug.com/517710554. */ + @supports blink-feature(AutofillPreviewGenericFontFamily) { + font-family: sans-serif !important; + } /* -webkit-small-control does not pin the font-feature-settings and we want previews to look consistent. */ font-feature-settings: normal !important; @@ -2264,6 +2271,11 @@ text-align: center; white-space: nowrap; font: -webkit-small-control !important; + /* See input::-internal-input-suggested: pin a generic family so an author + @font-face can't detect the autofill preview text. */ + @supports blink-feature(AutofillPreviewGenericFontFamily) { + font-family: sans-serif !important; + } font-feature-settings: normal !important; } diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5 index 76322a5..51cb1fd 100644 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5 @@ -782,6 +782,13 @@ public: true, }, { + // Pins a generic font-family on the autofill preview pseudo-elements so + // an author @font-face cannot oracle the previewed text. + // crbug.com/517710554. + name: "AutofillPreviewGenericFontFamily", + status: "stable", + }, + { name: "AutomationControlled", base_feature: "none", public: true, diff --git a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc index c51cd2e..2abce2a 100644 --- a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc +++ b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc @@ -31,6 +31,7 @@ #include "third_party/blink/renderer/core/input_type_names.h" #include "third_party/blink/renderer/core/layout/layout_object.h" #include "third_party/blink/renderer/core/loader/empty_clients.h" +#include "third_party/blink/renderer/core/style/computed_style.h" #include "third_party/blink/renderer/core/testing/null_execution_context.h" #include "third_party/blink/renderer/core/testing/page_test_base.h" #include "third_party/blink/renderer/platform/heap/garbage_collected.h" @@ -687,4 +688,19 @@ EXPECT_FALSE(targets->Contains(&input)); } +TEST_F(HTMLInputElementTest, SuggestedValueFontFamilyIsGeneric) { + GetDocument().body()->SetInnerHTMLWithoutTrustedTypes("<input id=test>"); + HTMLInputElement& input = TestElement(); + UpdateAllLifecyclePhasesForTest(); + + input.SetSuggestedValue("preview"); + UpdateAllLifecyclePhasesForTest(); + + HTMLElement* placeholder = input.PlaceholderElement(); + ASSERT_TRUE(placeholder); + const ComputedStyle* style = placeholder->GetComputedStyle(); + ASSERT_TRUE(style); + EXPECT_TRUE(style->GetFontDescription().Family().FamilyIsGeneric()); +} + } // namespace blink diff --git a/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html b/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html new file mode 100644 index 0000000..d431d17 --- /dev/null +++ b/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html @@ -0,0 +1,72 @@ +<!DOCTYPE html> +<html> +<head> +<title>Author @font-face must not shadow autofill preview text.</title> +<!-- Regression test for crbug.com/517710554. --> +<script src="../../resources/testharness.js"></script> +<script src="../../resources/testharnessreport.js"></script> +</head> +<body> +<script> +'use strict'; + +// The autofill preview pins a generic font-family, which an author @font-face +// can never match. That generic resolves to a concrete platform family for +// rendering (Arial on Windows/Linux, Helvetica on macOS); register author +// faces for both, with a unicode-range covering the preview text, so a leak +// would be caught on whichever family the running platform uses. +const PROBE_FAMILIES = ['Arial', 'Helvetica']; + +function addProbes(t) { + const probes = PROBE_FAMILIES.map(family => { + const face = new FontFace( + family, + 'url("./resources/nonexistent-font-for-autofill-leak-test.woff2")', + { unicodeRange: 'U+0041-007A' }); + document.fonts.add(face); + return face; + }); + t.add_cleanup(() => { probes.forEach(p => document.fonts.delete(p)); }); + return probes; +} + +function waitTwoFrames() { + return new Promise(resolve => { + requestAnimationFrame(() => requestAnimationFrame(() => resolve())); + }); +} + +// Creates an isolated control, previews a value on it, and asserts that no +// author @font-face was consulted to render the preview text. The control is +// created per-test so unrelated elements can't load the probe. +async function assertNoFontFaceLoad(t, tagName) { + const control = document.createElement(tagName); + document.body.appendChild(control); + t.add_cleanup(() => { control.remove(); }); + + const probes = addProbes(t); + probes.forEach(p => assert_equals(p.status, 'unloaded')); + + internals.setSuggestedValue(control, 'Alice'); + control.offsetWidth; + await waitTwoFrames(); + + for (const probe of probes) { + assert_equals(probe.status, 'unloaded', + `author @font-face "${probe.family}" must not be consulted for ` + + 'autofill preview text (crbug.com/517710554)'); + } +} + +promise_test(async t => { + assert_true(!!window.internals, 'This test requires window.internals.'); + await assertNoFontFaceLoad(t, 'input'); +}, 'input::-internal-input-suggested does not leak via author @font-face'); + +promise_test(async t => { + assert_true(!!window.internals, 'This test requires window.internals.'); + await assertNoFontFaceLoad(t, 'textarea'); +}, 'textarea::-internal-input-suggested does not leak via author @font-face'); +</script> +</body> +</html> diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html index e8f8fbed..5d6efc0 100644 --- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html +++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html @@ -1,4 +1,5 @@ -<input id="input" value="hello" style="width: 99px" > +<!-- Match the generic font-family the UA stylesheet pins on autofill previews. --> +<input id="input" value="hello" style="width: 99px; font-family: sans-serif" > <script> input.focus(); input.setSelectionRange(0,0); diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html index 30e454a..cd1b56d8 100644 --- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html +++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html @@ -1,4 +1,5 @@ -<input id="input" value="Springfield"> +<!-- Match the generic font-family the UA stylesheet pins on autofill previews. --> +<input id="input" value="Springfield" style="font-family: sans-serif"> <script> internals.setAutofilled(input, true); </script> diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html index 30e454a..cd1b56d8 100644 --- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html +++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html @@ -1,4 +1,5 @@ -<input id="input" value="Springfield"> +<!-- Match the generic font-family the UA stylesheet pins on autofill previews. --> +<input id="input" value="Springfield" style="font-family: sans-serif"> <script> internals.setAutofilled(input, true); </script> diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html index 2a9bfb0..b93be19 100644 --- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html +++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html @@ -1,4 +1,5 @@ -<input id="input" maxlength="5" value="Miste"> +<!-- Match the generic font-family the UA stylesheet pins on autofill previews. --> +<input id="input" maxlength="5" value="Miste" style="font-family: sans-serif"> <script> input.focus(); input.setSelectionRange(0,0); diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html index 37aa249..e78476a39 100644 --- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html +++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html @@ -1,7 +1,8 @@ <!DOCTYPE html> <meta name=fuzzy content="maxDifference=0-3; totalPixels=0-100"> <script src="../../../resources/ahem.js"></script> -<input id="input" value="Guy WithAVeryLongLastNameThatCouldWrap" style="width: 99px;" > +<!-- Match the generic font-family the UA stylesheet pins on autofill previews. --> +<input id="input" value="Guy WithAVeryLongLastNameThatCouldWrap" style="width: 99px; font-family: sans-serif;" > <script> input.focus(); input.setSelectionRange(0,0); diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html index 8d300293..e45c44a 100644 --- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html +++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html @@ -1,4 +1,5 @@ -<input id="input" value="hello" style="width: 99px"> +<!-- Match the generic font-family the UA stylesheet pins on autofill previews. --> +<input id="input" value="hello" style="width: 99px; font-family: sans-serif"> <script> internals.setAutofilled(input, true); </script> diff --git a/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html b/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html index 03fcf667..0d7c3e0 100644 --- a/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html +++ b/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html @@ -1,4 +1,5 @@ -<input id="input" type="password" value="MyPassword" style="width: 99px" > +<!-- Match the generic font-family the UA stylesheet pins on autofill previews. --> +<input id="input" type="password" value="MyPassword" style="width: 99px; font-family: sans-serif" > <script> input.focus(); input.setSelectionRange(0,0);
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
index c51cd2e..2abce2a 100644
--- a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
+++ b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
@@ -31,6 +31,7 @@
#include "third_party/blink/renderer/core/input_type_names.h"
#include "third_party/blink/renderer/core/layout/layout_object.h"
#include "third_party/blink/renderer/core/loader/empty_clients.h"
+#include "third_party/blink/renderer/core/style/computed_style.h"
#include "third_party/blink/renderer/core/testing/null_execution_context.h"
#include "third_party/blink/renderer/core/testing/page_test_base.h"
#include "third_party/blink/renderer/platform/heap/garbage_collected.h"
@@ -687,4 +688,19 @@
EXPECT_FALSE(targets->Contains(&input));
}
+TEST_F(HTMLInputElementTest, SuggestedValueFontFamilyIsGeneric) {
+ GetDocument().body()->SetInnerHTMLWithoutTrustedTypes("<input id=test>");
+ HTMLInputElement& input = TestElement();
+ UpdateAllLifecyclePhasesForTest();
+
+ input.SetSuggestedValue("preview");
+ UpdateAllLifecyclePhasesForTest();
+
+ HTMLElement* placeholder = input.PlaceholderElement();
+ ASSERT_TRUE(placeholder);
+ const ComputedStyle* style = placeholder->GetComputedStyle();
+ ASSERT_TRUE(style);
+ EXPECT_TRUE(style->GetFontDescription().Family().FamilyIsGeneric());
+}
+
} // namespace blink
diff --git a/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html b/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html
new file mode 100644
index 0000000..d431d17
--- /dev/null
+++ b/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html
@@ -0,0 +1,72 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Author @font-face must not shadow autofill preview text.</title>
+<!-- Regression test for crbug.com/517710554. -->
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+'use strict';
+
+// The autofill preview pins a generic font-family, which an author @font-face
+// can never match. That generic resolves to a concrete platform family for
+// rendering (Arial on Windows/Linux, Helvetica on macOS); register author
+// faces for both, with a unicode-range covering the preview text, so a leak
+// would be caught on whichever family the running platform uses.
+const PROBE_FAMILIES = ['Arial', 'Helvetica'];
+
+function addProbes(t) {
+ const probes = PROBE_FAMILIES.map(family => {
+ const face = new FontFace(
+ family,
+ 'url("./resources/nonexistent-font-for-autofill-leak-test.woff2")',
+ { unicodeRange: 'U+0041-007A' });
+ document.fonts.add(face);
+ return face;
+ });
+ t.add_cleanup(() => { probes.forEach(p => document.fonts.delete(p)); });
+ return probes;
+}
+
+function waitTwoFrames() {
+ return new Promise(resolve => {
+ requestAnimationFrame(() => requestAnimationFrame(() => resolve()));
+ });
+}
+
+// Creates an isolated control, previews a value on it, and asserts that no
+// author @font-face was consulted to render the preview text. The control is
+// created per-test so unrelated elements can't load the probe.
+async function assertNoFontFaceLoad(t, tagName) {
+ const control = document.createElement(tagName);
+ document.body.appendChild(control);
+ t.add_cleanup(() => { control.remove(); });
+
+ const probes = addProbes(t);
+ probes.forEach(p => assert_equals(p.status, 'unloaded'));
+
+ internals.setSuggestedValue(control, 'Alice');
+ control.offsetWidth;
+ await waitTwoFrames();
+
+ for (const probe of probes) {
+ assert_equals(probe.status, 'unloaded',
+ `author @font-face "${probe.family}" must not be consulted for ` +
+ 'autofill preview text (crbug.com/517710554)');
+ }
+}
+
+promise_test(async t => {
+ assert_true(!!window.internals, 'This test requires window.internals.');
+ await assertNoFontFaceLoad(t, 'input');
+}, 'input::-internal-input-suggested does not leak via author @font-face');
+
+promise_test(async t => {
+ assert_true(!!window.internals, 'This test requires window.internals.');
+ await assertNoFontFaceLoad(t, 'textarea');
+}, 'textarea::-internal-input-suggested does not leak via author @font-face');
+</script>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
index e8f8fbed..5d6efc0 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="hello" style="width: 99px" >
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="hello" style="width: 99px; font-family: sans-serif" >
<script>
input.focus();
input.setSelectionRange(0,0);
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
index 30e454a..cd1b56d8 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="Springfield">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="Springfield" style="font-family: sans-serif">
<script>
internals.setAutofilled(input, true);
</script>
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
index 30e454a..cd1b56d8 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="Springfield">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="Springfield" style="font-family: sans-serif">
<script>
internals.setAutofilled(input, true);
</script>
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
index 2a9bfb0..b93be19 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
@@ -1,4 +1,5 @@
-<input id="input" maxlength="5" value="Miste">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" maxlength="5" value="Miste" style="font-family: sans-serif">
<script>
input.focus();
input.setSelectionRange(0,0);
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
index 37aa249..e78476a39 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
@@ -1,7 +1,8 @@
<!DOCTYPE html>
<meta name=fuzzy content="maxDifference=0-3; totalPixels=0-100">
<script src="../../../resources/ahem.js"></script>
-<input id="input" value="Guy WithAVeryLongLastNameThatCouldWrap" style="width: 99px;" >
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="Guy WithAVeryLongLastNameThatCouldWrap" style="width: 99px; font-family: sans-serif;" >
<script>
input.focus();
input.setSelectionRange(0,0);
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
index 8d300293..e45c44a 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="hello" style="width: 99px">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="hello" style="width: 99px; font-family: sans-serif">
<script>
internals.setAutofilled(input, true);
</script>
diff --git a/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html b/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
index 03fcf667..0d7c3e0 100644
--- a/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
@@ -1,4 +1,5 @@
-<input id="input" type="password" value="MyPassword" style="width: 99px" >
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" type="password" value="MyPassword" style="width: 99px; font-family: sans-serif" >
<script>
input.focus();
input.setSelectionRange(0,0);
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page