Hi, This change has a lot in common with the MathML change described in this thread <https://groups.google.com/a/chromium.org/g/blink-dev/c/kmtYoVZjtZE/m/VK7ps7U3AAAJ>. Could we please make sure that the security questions on that thread are also covered for this change?
In particular, * Will this enable navigation to javaScript: URLs? * If so, will these navigations be covered by CSP? It would be best to have some WPT coverage testing this. Thanks, Mustafa On Tuesday, July 28, 2026 at 5:49:05 AM UTC-7 [email protected] wrote: > Contact emails > [email protected] > > Specification > https://github.com/w3c/svgwg/pull/1052 > > Summary > Recently some attributes of HTMLHyperlinkElementUtils have been moved into > a new HyperlinkElementUtils interface which will be shared by > HTML/SVG/MathML.[1] > > In the spec, the SVG a element should implement HTMLHyperlinkElementUtils, > but in practice no one was doing that because there are attributes that > conflict between HTMLHyperlinkElementUtils and SVGURIReference. [2] > > In this feature we will add attributes like origin, protocol, username, > password, host, hostname, port, pathname, search and hash to the SVG a > element by implementing the new HyperlinkElementUtils mixin.[3] > > [1] https://chromium-review.googlesource.com/c/chromium/src/+/7899676 > [2] https://github.com/w3c/svgwg/issues/312 > [3] https://chromium-review.googlesource.com/c/chromium/src/+/8015702 > > Blink component > Blink>SVG > > Web Feature ID > Missing feature > > Motivation > Recent developments in standards bodies have led to a renewed effort to > align the various hyperlink elements, this change brings the 'origin', > 'protocol', 'pathname' etc properties that already exist on HTML and MathML > <a> to the SVG <a> element. > > Initial public proposal > https://github.com/w3c/svgwg/issues/312 > > Goals for experimentation > None > > Requires code in //chrome? > False > > Tracking bug > https://issues.chromium.org/issues/512726601 > > Estimated milestones > No milestones specified > > > > Link to entry on the Chrome Platform Status > https://chromestatus.com/feature/5990570242736128?gate=6408874992205824 > > This intent message was generated by Chrome Platform Status. -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/d0bb2096-273c-414a-8aa8-e1e931e2090an%40chromium.org.
