body /deep/ span reveals cleartext #7
Description
The /deep/ combinator can cross the shadow boundary, allowing a host script read/write access the same cleartext DOM presented to the user.
A parent application can easily get all ShadowCrypt cleartext on a page:
[].slice.call(document.querySelectorAll('body /deep/ span'))
.map(function(el) {
return el.innerText
}).join('\n')Not sure there's a way around it at this point.