HTML-in-Canvas Demos

Re:HTML-in-Canvas Demos by Rygian on Wednesday May 20, 2026 @05:17AM (#48205088)

How long until a canvas is used to render the full chrome of a web browser (e.g. including the TLS padlock), showing a fake benign URL in the (fake) address bar while having the user interact with a malicious page?

[ Parent | on HN ]

Re:HTML-in-Canvas Demos by l23k4 on Wednesday May 20, 2026 @07:34AM (#48206088)

Already done, it's called a "browser-in-browser" attack.

[ Parent | on HN ]

Re:HTML-in-Canvas Demos by stanac on Wednesday May 20, 2026 @05:31AM (#48205181)

That's why we have "youtube.com is now full screen" message.

[ Parent | on HN ]

Re:HTML-in-Canvas Demos by lukan on Wednesday May 20, 2026 @06:05AM (#48205422)

Yes, but this "emergency" UI of the OS could be improved I think. (Also that functionality could have been build easily with normal DOM and JS, cancel and override all events, etc)

[ Parent | on HN ]