From d514b24be816134378c44660782560b16685a29e Mon Sep 17 00:00:00 2001
From: Stephen Chenney <schenney@chromium.org>
Date: Mon, 31 Aug 2026 19:44:38 -0700
Subject: [PATCH] [HiC] Fix privacy leaks due to feature flag checks

When a frame that does not enable HTML-in-Canvas embeds a same-origin
iframe that does enable the origin trial (through headers in the
subframe request) the sub-frame can use drawElementImage with
cross-origin filter content and the checks in the main frame painting
code will not remove the filter, because the main frame does not think
HTML-in-Canvas is enabled.

Fix the cross-origin filter removal code to check for canvas subtree
instead of using the feature flag. While this will remove filters in
canvas subtrees even if HTML-in-Canvas is not enabled, it doesn't matter
because the filters are not exposed to a11y and there is otherwise no
way to see them.

Bug: 550141694
Change-Id: I3dc8f8d9f157ee2a3f73851687a04d537b1dcef9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8310987
Commit-Queue: Stephen Chenney <schenney@chromium.org>
Reviewed-by: Stefan Zager <szager@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1689553}
---

diff --git a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
index f4c17437..d1a242b 100644
--- a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
+++ b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
@@ -2636,9 +2636,7 @@
       UpdateFilterEffect(object_, properties_->Filter(), filter_info);
       bool is_filter_tainted = filter_info.operations.OriginTainted();
       bool is_filter_disallowed =
-          RuntimeEnabledFeatures::CanvasDrawElementEnabled(
-              object_.GetDocument().GetExecutionContext()) &&
-          object_.IsInCanvasSubtree() && is_filter_tainted;
+          state.is_in_drawable_canvas_subtree && is_filter_tainted;
       if (!(filter_info.operations.IsEmpty() || is_filter_disallowed)) {
         state.filter_info =
             std::make_unique<EffectPaintPropertyNode::FilterInfo>(
@@ -4416,9 +4414,7 @@
   }
   if (!operations.IsEmpty()) {
     bool is_filter_disallowed =
-        RuntimeEnabledFeatures::CanvasDrawElementEnabled(
-            object_.GetDocument().GetExecutionContext()) &&
-        object_.IsInCanvasSubtree() && operations.OriginTainted();
+        state.is_in_drawable_canvas_subtree && operations.OriginTainted();
     if (!is_filter_disallowed) {
       state.backdrop_filter_info =
           base::WrapUnique(new EffectPaintPropertyNode::BackdropFilterInfo{