PatchGap
Chrome · Fonts

CVE-2026-91714

Info Disclosure in Fonts
Medium watch CVSS 5.3 chrome Info Disclosure 🔧 Commit mapped

Overview

Medium
Severity
5.3
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactObservable discrepancy in Fonts
DescriptionObservable discrepancy in Fonts
ComponentFonts
Bug ClassInfo Disclosure
Action tierwatch — information disclosure — security-relevant, below the RCE-class bar
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker517710554
Fix commit6d75158e8ce3 (chromium/src) +121/-7
CWECWE-203
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-05-29 (per vendor advisory)
Fix landed2026-06-24 (public git)
Disclosed2026-09-15
Patch gap83 days — fix public in source before the advisory

Background

Autofill preview pseudo-elements
::-internal-input-suggested (on input/textarea) and ::-internal-select-autofill-preview-text (on select) are internal Blink pseudo-elements that render the browser-supplied preview of a suggested/autofilled value before the user commits it.
`font: -webkit-small-control`
a CSS system-font shorthand that Blink expands to a concrete platform family name (e.g. Arial on Windows/Linux, Helvetica on macOS) rather than a generic family.
Author `@font-face` with `unicode-range`
a page-declared font face bound to a family name and restricted to a range of code points; the browser only fetches its url() resource when text using that family actually contains a code point inside the range.
Generic font family
families like sans-serif that resolve directly to a platform font and are never matched against author @font-face declarations (FontDescription::Family::FamilyIsGeneric() returns true).

Root Cause Analysis

The user-agent stylesheet styled the autofill preview pseudo-elements with font: -webkit-small-control !important, and this system font resolves to a concrete family name such as Arial. Because a concrete family name participates in normal font matching, an author-declared @font-face for that same name (with a narrow unicode-range) could be consulted when rendering the privileged preview text. That gave the page a side channel: the browser fetches the author font’s url() only if the preview string contains a code point in the declared range, so observing whether the request fires discloses characters of the previewed (autofilled) value. The invariant that browser-generated preview content must not be observable by the page was therefore violated.

The fix appends font-family: sans-serif !important (guarded by the new AutofillPreviewGenericFontFamily feature) after the shorthand, forcing the family to a generic one; generic families are never matched against author @font-face, so no author face can be consulted and the oracle disappears. The regression test asserts Family().FamilyIsGeneric() on the preview placeholder and that the probe faces stay unloaded.

Key insight
The single mistake was pinning the preview font to a concrete platform family, which is subject to author @font-face matching; pinning a generic family (sans-serif) instead removes the preview text from the author font-matching path entirely, closing the disclosure channel.

Attack Path

  1. Declare a probing font face The page registers an author @font-face for the concrete family the preview uses (e.g. Arial/Helvetica) with a narrow unicode-range covering candidate characters, whose url() points to an attacker-observable resource.
  2. Trigger an autofill preview The page presents a form control so the browser renders suggested/autofilled preview text through ::-internal-input-suggested or ::-internal-select-autofill-preview-text, which pre-patch resolved to that concrete family.
  3. Observe the conditional fetch Because the concrete family matched the author face, the browser requests the font url() only when the preview text contains a code point inside the declared range, signaling a character match to the attacker.
  4. Reconstruct the previewed value (inferred) By repeating with progressively narrowed single-character unicode-range faces, the attacker can extrapolate which characters the preview contains and reconstruct the sensitive autofilled value; the patch demonstrates the single-face oracle but not full string recovery.

Impact Assessment

An attacking page gains an observable discrepancy — a font-load oracle — that lets it detect characters of browser-generated autofill preview text (potentially sensitive suggested values) from within the renderer/page context, before the user commits the value. The precondition is that the user has an autofill suggestion previewed for a control on the attacker’s page, and the attacker can observe the resulting font resource request. The advisory classifies this as a LogicError / “Observable discrepancy in Fonts”; reconstruction of a complete sensitive value and any broader escalation is (inferred) and not demonstrated by the patch, and there is no in-the-wild-exploitation claim in the provided advisory.

Changed Functions

FunctionChangeNotes
TEST_F
third_party/blink/renderer/core/html/forms/html_input_element_test.cc
 modified
for
third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html
 modified

Files Changed

  • third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
  • third_party/blink/renderer/platform/runtime_enabled_features.json5
  • third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html
  • third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
  • third_party/blink/renderer/core/html/resources/html.css
  • third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
  • third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
  • third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
  • third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
  • third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
  • third_party/blink/renderer/core/html/forms/html_input_element_test.cc

Audit Directions

  • System-font resolution to concrete families
    Audit other UA-stylesheet rules that use font: -webkit-small-control or similar system fonts on browser-privileged/internal pseudo-elements, since these resolve to concrete family names subject to author @font-face matching.
  • Privileged text exposed to author font matching
    Look for any browser-generated or privileged text (placeholders, previews, spellcheck, generated content) rendered with a concrete family, where an author @font-face plus unicode-range could act as a per-character load oracle.
  • `unicode-range` conditional-fetch side channels
    Review features where text content the page should not read is rendered in a way that lets a unicode-range-restricted author font’s conditional network fetch reveal character presence.

Patch

view commit
From 6d75158e8ce3027e3557ec04808067a0ad39b30d Mon Sep 17 00:00:00 2001
From: Dileep Maurya <dileepmaurya@microsoft.com>
Date: Wed, 24 Jun 2026 10:58:58 -0700
Subject: [PATCH] Pin suggested-value pseudo elements to a generic font family

`font: -webkit-small-control` resolves font-family to a concrete
platform name (e.g. "Arial"), so the !important rule on
`::-internal-input-suggested` and
`::-internal-select-autofill-preview-text` could still pick up an
author @font-face declared for that name. Append
`font-family: sans-serif !important` after the shorthand so the
preview text always resolves to a generic family, matching the
existing `textarea::-internal-input-suggested` rule.

Bug: 517710554
Change-Id: I063833950480d20453491d5a07dea842c0b061d1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7930489
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Commit-Queue: Dileep Maurya <dileepmaurya@microsoft.com>
Reviewed-by: Kevin Babbitt <kbabbitt@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1651835}
---
diff --git a/third_party/blink/renderer/core/html/resources/html.css b/third_party/blink/renderer/core/html/resources/html.css
index a6baa41b1..829b476f 100644
--- a/third_party/blink/renderer/core/html/resources/html.css
+++ b/third_party/blink/renderer/core/html/resources/html.css
@@ -637,6 +637,13 @@
 input::-internal-input-suggested,
 textarea::-internal-input-suggested {
     font: -webkit-small-control !important;
+    /* font: -webkit-small-control resolves to Arial on every platform. Ideally
+       we'd keep Arial, but a concrete family is matched against author
+       @font-face, so a single-character unicode-range could disclose the
+       preview text; a generic family avoids that lookup. crbug.com/517710554. */
+    @supports blink-feature(AutofillPreviewGenericFontFamily) {
+      font-family: sans-serif !important;
+    }
     /* -webkit-small-control does not pin the font-feature-settings and we want
        previews to look consistent. */
     font-feature-settings: normal !important;
@@ -2264,6 +2271,11 @@
   text-align: center;
   white-space: nowrap;
   font: -webkit-small-control !important;
+  /* See input::-internal-input-suggested: pin a generic family so an author
+     @font-face can't detect the autofill preview text. */
+  @supports blink-feature(AutofillPreviewGenericFontFamily) {
+    font-family: sans-serif !important;
+  }
   font-feature-settings: normal !important;
 }
 
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index 76322a5..51cb1fd 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -782,6 +782,13 @@
       public: true,
     },
     {
+      // Pins a generic font-family on the autofill preview pseudo-elements so
+      // an author @font-face cannot oracle the previewed text.
+      // crbug.com/517710554.
+      name: "AutofillPreviewGenericFontFamily",
+      status: "stable",
+    },
+    {
       name: "AutomationControlled",
       base_feature: "none",
       public: true,
diff --git a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
index c51cd2e..2abce2a 100644
--- a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
+++ b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
@@ -31,6 +31,7 @@
 #include "third_party/blink/renderer/core/input_type_names.h"
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/loader/empty_clients.h"
+#include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/testing/null_execution_context.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
@@ -687,4 +688,19 @@
   EXPECT_FALSE(targets->Contains(&input));
 }
 
+TEST_F(HTMLInputElementTest, SuggestedValueFontFamilyIsGeneric) {
+  GetDocument().body()->SetInnerHTMLWithoutTrustedTypes("<input id=test>");
+  HTMLInputElement& input = TestElement();
+  UpdateAllLifecyclePhasesForTest();
+
+  input.SetSuggestedValue("preview");
+  UpdateAllLifecyclePhasesForTest();
+
+  HTMLElement* placeholder = input.PlaceholderElement();
+  ASSERT_TRUE(placeholder);
+  const ComputedStyle* style = placeholder->GetComputedStyle();
+  ASSERT_TRUE(style);
+  EXPECT_TRUE(style->GetFontDescription().Family().FamilyIsGeneric());
+}
+
 }  // namespace blink
diff --git a/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html b/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html
new file mode 100644
index 0000000..d431d17
--- /dev/null
+++ b/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html
@@ -0,0 +1,72 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Author @font-face must not shadow autofill preview text.</title>
+<!-- Regression test for crbug.com/517710554. -->
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+'use strict';
+
+// The autofill preview pins a generic font-family, which an author @font-face
+// can never match. That generic resolves to a concrete platform family for
+// rendering (Arial on Windows/Linux, Helvetica on macOS); register author
+// faces for both, with a unicode-range covering the preview text, so a leak
+// would be caught on whichever family the running platform uses.
+const PROBE_FAMILIES = ['Arial', 'Helvetica'];
+
+function addProbes(t) {
+  const probes = PROBE_FAMILIES.map(family => {
+    const face = new FontFace(
+        family,
+        'url("./resources/nonexistent-font-for-autofill-leak-test.woff2")',
+        { unicodeRange: 'U+0041-007A' });
+    document.fonts.add(face);
+    return face;
+  });
+  t.add_cleanup(() => { probes.forEach(p => document.fonts.delete(p)); });
+  return probes;
+}
+
+function waitTwoFrames() {
+  return new Promise(resolve => {
+    requestAnimationFrame(() => requestAnimationFrame(() => resolve()));
+  });
+}
+
+// Creates an isolated control, previews a value on it, and asserts that no
+// author @font-face was consulted to render the preview text. The control is
+// created per-test so unrelated elements can't load the probe.
+async function assertNoFontFaceLoad(t, tagName) {
+  const control = document.createElement(tagName);
+  document.body.appendChild(control);
+  t.add_cleanup(() => { control.remove(); });
+
+  const probes = addProbes(t);
+  probes.forEach(p => assert_equals(p.status, 'unloaded'));
+
+  internals.setSuggestedValue(control, 'Alice');
+  control.offsetWidth;
+  await waitTwoFrames();
+
+  for (const probe of probes) {
+    assert_equals(probe.status, 'unloaded',
+        `author @font-face "${probe.family}" must not be consulted for ` +
+        'autofill preview text (crbug.com/517710554)');
+  }
+}
+
+promise_test(async t => {
+  assert_true(!!window.internals, 'This test requires window.internals.');
+  await assertNoFontFaceLoad(t, 'input');
+}, 'input::-internal-input-suggested does not leak via author @font-face');
+
+promise_test(async t => {
+  assert_true(!!window.internals, 'This test requires window.internals.');
+  await assertNoFontFaceLoad(t, 'textarea');
+}, 'textarea::-internal-input-suggested does not leak via author @font-face');
+</script>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
index e8f8fbed..5d6efc0 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="hello" style="width: 99px" >
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="hello" style="width: 99px; font-family: sans-serif" >
 <script>
 input.focus();
 input.setSelectionRange(0,0);
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
index 30e454a..cd1b56d8 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="Springfield">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="Springfield" style="font-family: sans-serif">
 <script>
 internals.setAutofilled(input, true);
 </script>
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
index 30e454a..cd1b56d8 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="Springfield">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="Springfield" style="font-family: sans-serif">
 <script>
 internals.setAutofilled(input, true);
 </script>
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
index 2a9bfb0..b93be19 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
@@ -1,4 +1,5 @@
-<input id="input" maxlength="5" value="Miste">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" maxlength="5" value="Miste" style="font-family: sans-serif">
 <script>
 input.focus();
 input.setSelectionRange(0,0);
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
index 37aa249..e78476a39 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
@@ -1,7 +1,8 @@
 <!DOCTYPE html>
 <meta name=fuzzy content="maxDifference=0-3; totalPixels=0-100">
 <script src="../../../resources/ahem.js"></script>
-<input id="input" value="Guy WithAVeryLongLastNameThatCouldWrap" style="width: 99px;" >
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="Guy WithAVeryLongLastNameThatCouldWrap" style="width: 99px; font-family: sans-serif;" >
 <script>
 input.focus();
 input.setSelectionRange(0,0);
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
index 8d300293..e45c44a 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="hello" style="width: 99px">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="hello" style="width: 99px; font-family: sans-serif">
 <script>
 internals.setAutofilled(input, true);
 </script>
diff --git a/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html b/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
index 03fcf667..0d7c3e0 100644
--- a/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
@@ -1,4 +1,5 @@
-<input id="input" type="password" value="MyPassword" style="width: 99px" >
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" type="password" value="MyPassword" style="width: 99px; font-family: sans-serif" >
 <script>
 input.focus();
 input.setSelectionRange(0,0);
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
index c51cd2e..2abce2a 100644
--- a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
+++ b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
@@ -31,6 +31,7 @@
 #include "third_party/blink/renderer/core/input_type_names.h"
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/loader/empty_clients.h"
+#include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/testing/null_execution_context.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
@@ -687,4 +688,19 @@
   EXPECT_FALSE(targets->Contains(&input));
 }
 
+TEST_F(HTMLInputElementTest, SuggestedValueFontFamilyIsGeneric) {
+  GetDocument().body()->SetInnerHTMLWithoutTrustedTypes("<input id=test>");
+  HTMLInputElement& input = TestElement();
+  UpdateAllLifecyclePhasesForTest();
+
+  input.SetSuggestedValue("preview");
+  UpdateAllLifecyclePhasesForTest();
+
+  HTMLElement* placeholder = input.PlaceholderElement();
+  ASSERT_TRUE(placeholder);
+  const ComputedStyle* style = placeholder->GetComputedStyle();
+  ASSERT_TRUE(style);
+  EXPECT_TRUE(style->GetFontDescription().Family().FamilyIsGeneric());
+}
+
 }  // namespace blink
diff --git a/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html b/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html
new file mode 100644
index 0000000..d431d17
--- /dev/null
+++ b/third_party/blink/web_tests/fast/forms/suggested-value-author-font-face-leak.html
@@ -0,0 +1,72 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Author @font-face must not shadow autofill preview text.</title>
+<!-- Regression test for crbug.com/517710554. -->
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+'use strict';
+
+// The autofill preview pins a generic font-family, which an author @font-face
+// can never match. That generic resolves to a concrete platform family for
+// rendering (Arial on Windows/Linux, Helvetica on macOS); register author
+// faces for both, with a unicode-range covering the preview text, so a leak
+// would be caught on whichever family the running platform uses.
+const PROBE_FAMILIES = ['Arial', 'Helvetica'];
+
+function addProbes(t) {
+  const probes = PROBE_FAMILIES.map(family => {
+    const face = new FontFace(
+        family,
+        'url("./resources/nonexistent-font-for-autofill-leak-test.woff2")',
+        { unicodeRange: 'U+0041-007A' });
+    document.fonts.add(face);
+    return face;
+  });
+  t.add_cleanup(() => { probes.forEach(p => document.fonts.delete(p)); });
+  return probes;
+}
+
+function waitTwoFrames() {
+  return new Promise(resolve => {
+    requestAnimationFrame(() => requestAnimationFrame(() => resolve()));
+  });
+}
+
+// Creates an isolated control, previews a value on it, and asserts that no
+// author @font-face was consulted to render the preview text. The control is
+// created per-test so unrelated elements can't load the probe.
+async function assertNoFontFaceLoad(t, tagName) {
+  const control = document.createElement(tagName);
+  document.body.appendChild(control);
+  t.add_cleanup(() => { control.remove(); });
+
+  const probes = addProbes(t);
+  probes.forEach(p => assert_equals(p.status, 'unloaded'));
+
+  internals.setSuggestedValue(control, 'Alice');
+  control.offsetWidth;
+  await waitTwoFrames();
+
+  for (const probe of probes) {
+    assert_equals(probe.status, 'unloaded',
+        `author @font-face "${probe.family}" must not be consulted for ` +
+        'autofill preview text (crbug.com/517710554)');
+  }
+}
+
+promise_test(async t => {
+  assert_true(!!window.internals, 'This test requires window.internals.');
+  await assertNoFontFaceLoad(t, 'input');
+}, 'input::-internal-input-suggested does not leak via author @font-face');
+
+promise_test(async t => {
+  assert_true(!!window.internals, 'This test requires window.internals.');
+  await assertNoFontFaceLoad(t, 'textarea');
+}, 'textarea::-internal-input-suggested does not leak via author @font-face');
+</script>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
index e8f8fbed..5d6efc0 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="hello" style="width: 99px" >
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="hello" style="width: 99px; font-family: sans-serif" >
 <script>
 input.focus();
 input.setSelectionRange(0,0);
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
index 30e454a..cd1b56d8 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-over-placeholder-value-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="Springfield">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="Springfield" style="font-family: sans-serif">
 <script>
 internals.setAutofilled(input, true);
 </script>
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
index 30e454a..cd1b56d8 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggested-value-when-underlying-placeholder-is-removed-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="Springfield">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="Springfield" style="font-family: sans-serif">
 <script>
 internals.setAutofilled(input, true);
 </script>
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
index 2a9bfb0..b93be19 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-suggestion-maxlength-expected.html
@@ -1,4 +1,5 @@
-<input id="input" maxlength="5" value="Miste">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" maxlength="5" value="Miste" style="font-family: sans-serif">
 <script>
 input.focus();
 input.setSelectionRange(0,0);
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
index 37aa249..e78476a39 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-very-long-value-expected.html
@@ -1,7 +1,8 @@
 <!DOCTYPE html>
 <meta name=fuzzy content="maxDifference=0-3; totalPixels=0-100">
 <script src="../../../resources/ahem.js"></script>
-<input id="input" value="Guy WithAVeryLongLastNameThatCouldWrap" style="width: 99px;" >
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="Guy WithAVeryLongLastNameThatCouldWrap" style="width: 99px; font-family: sans-serif;" >
 <script>
 input.focus();
 input.setSelectionRange(0,0);
diff --git a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
index 8d300293..e45c44a 100644
--- a/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/input-appearance-autocomplete-with-initial-value-expected.html
@@ -1,4 +1,5 @@
-<input id="input" value="hello" style="width: 99px">
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" value="hello" style="width: 99px; font-family: sans-serif">
 <script>
 internals.setAutofilled(input, true);
 </script>
diff --git a/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html b/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
index 03fcf667..0d7c3e0 100644
--- a/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
+++ b/third_party/blink/web_tests/fast/forms/text/password-input-suggested-value-appearance-expected.html
@@ -1,4 +1,5 @@
-<input id="input" type="password" value="MyPassword" style="width: 99px" >
+<!-- Match the generic font-family the UA stylesheet pins on autofill previews. -->
+<input id="input" type="password" value="MyPassword" style="width: 99px; font-family: sans-serif" >
 <script>
 input.focus();
 input.setSelectionRange(0,0);
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page