Dear Group, this is a finding from the Security Review.
Reviewed version: 4 June 2026 WAI-ARIA 1.3 Working Draft.
Security and privacy self-review: w3c/aria issue #2814
The aria-notify policy relaxes the Permission Policy default
Concern: WAI-ARIA 1.3 introduces Document.ariaNotify(), allowing documents to send author-controlled announcements through the accessibility platform. The security boundary works as follows:
- A document calls
ariaNotify() to generate an announcement.
- Access is controlled by the
aria-notify Permission Policy.
- The policy has a default allowlist of
*.
- Consequently, a cross-origin frame does not require explicit delegation from the embedding document.
- Repeated calls may produce notification flooding or other forms of user disruption, while the intended filtering behavior remains unresolved.
Even if the HTML discussion presents the * default as supporting accessibility by default. However, it also relaxes the usual secure-by-default boundary for cross-origin content, and the current Security Considerations do not explain this trade-off.
Impact: Untrusted cross-origin content may use the announcement channel without prior delegation. Depending on browser and assistive technology behavior, repeated or misleading announcements could disrupt users or interfere with their understanding of the page.
Recommendation: Understand if the permission policy is necessary for this feature and if the default allowlist of * is necessary, as it depends on the actual usage of ariaNotify(). If necessary, the specification should explain the trade-off of relaxing secure-by-default and which accessibility requirements justify the relaxation; otherwise, updating the default should be fine.
Affected sections:
Thanks,
Simone
P.S. If you have any suggestions for testing the feature (e.g., assistive technology to put in the lab), I'd be happy to hear them.
Dear Group, this is a finding from the Security Review.
Reviewed version: 4 June 2026 WAI-ARIA 1.3 Working Draft.
Security and privacy self-review: w3c/aria issue #2814
The
aria-notifypolicy relaxes the Permission Policy defaultConcern: WAI-ARIA 1.3 introduces
Document.ariaNotify(), allowing documents to send author-controlled announcements through the accessibility platform. The security boundary works as follows:ariaNotify()to generate an announcement.aria-notifyPermission Policy.*.Even if the HTML discussion presents the
*default as supporting accessibility by default. However, it also relaxes the usual secure-by-default boundary for cross-origin content, and the current Security Considerations do not explain this trade-off.Impact: Untrusted cross-origin content may use the announcement channel without prior delegation. Depending on browser and assistive technology behavior, repeated or misleading announcements could disrupt users or interfere with their understanding of the page.
Recommendation: Understand if the permission policy is necessary for this feature and if the default allowlist of
*is necessary, as it depends on the actual usage ofariaNotify(). If necessary, the specification should explain the trade-off of relaxing secure-by-default and which accessibility requirements justify the relaxation; otherwise, updating the default should be fine.Affected sections:
Thanks,
Simone
P.S. If you have any suggestions for testing the feature (e.g., assistive technology to put in the lab), I'd be happy to hear them.