Hi, In bug 1548773, annevk suggested to unship the `typeMustMatch`attribute from <object> elements[1].
No other browser supports this and we have just learned that this attribute can be used to leak information about cross-origin resources[2]. While it seems worth removing immediately to me, I'm interested in additional feedback. Thanks, Freddy [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1548773 [2] https://github.com/xsleaks/xsleaks/wiki/Browser-Side-Channels#object-typemustmatch _______________________________________________ dev-platform mailing list [email protected] https://lists.mozilla.org/listinfo/dev-platform
