lolsob.

[mcc@mastodon.social]

lolsob. Developer attempts to replicate liquid glass in CSS and in the process accidentally discovers a novel and rather serious browser vulnerability

https://lyra.horse/blog/2025/12/svg-clickjacking/

"CSS hack accidentally becomes regular hack"

( via @citrusui )

[oblomov@sociale.network]

@mcc @citrusui are the browser implementors going to “fix” this by removing filters from SVG or SVG support entirely? 8-(

[mcc@mastodon.social]

@oblomov @citrusui it seems like blocking SVG filters from obscuring iframes would be a kinda reasonable response?

[oblomov@sociale.network]

@mcc @citrusui I can't say I have much trust in current browser developers to choose the reasonable response.