WebKit VS chromium

Chrome 77 removed the prominent green EV badge. "A series of academic research in the 2000s studied the EV UI in lab and survey settings, and found that the EV UI was not protecting against phishing attacks as intended. The Chrome Security UX team recently published a study that updated these findings with a large-scale field experiment, as well as a series of survey experiments." [1]

Extended Validation can still play a role in a corporate's IT control framework; the extended validation is essentially a check-of-paperwork that then doesn't need to be performed by your own auditor. Some EV certificates also come with some (probably completely useless) liability insurance.

[1] https://chromium.googlesource.com/chromium/src/%2B/HEAD/docs...

https://github.com/chromium/chromium/blob/main/LICENSE

  // Redistribution and use in source and binary forms, with or without

Distributing for linux sucks. There are dozen different ways to install applications and not a single format could be installed by say top 5 distro. I was hopeful for Snap, but it is awful in my experience. Unless the package is managed by the distribution itself, installing it sucks. e.g. Here is link for chromium binaries for linux[1].

[1]: https://chromium.googlesource.com/chromium/src/+/refs/heads/...

Yes [4].

> [1] The library is used as of 2023 in Google Chrome, ChromeOS, ChromiumOS, Mozilla Firefox, Mozilla Thunderbird, Android, Firefox OS, Flutter,[5] Avalonia (from Alpha 4), LibreOffice (from version 7.0) and RAD Studio[6](since version 12.0).

> [2] Changes to the Skia repository will be rolled into Chromium by the AutoRoll bot several times per day.

> [3] It serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and many other products.

[1]: https://en.wikipedia.org/wiki/Skia_Graphics_Engine

[2]: https://skia.org/docs/dev/chrome/

[3]: https://skia.org/

[4]: https://github.com/chromium/chromium/tree/main/skia

There are conventions around that. https://chromium.googlesource.com/chromium/src/+/main/docs/i... Generally, if all the characters are from one script, then it is decoded. There are lots of exceptions detailed there, but it's harder to make a homoglyph attack work using only characters from one script to impersonate another.

> I've found no other mention of this on the internet

Here's one! (different character, but same issue it seems?)

https://www.reddit.com/r/linuxquestions/comments/1cbarz5/ele...

> and I'd love to to hunt this down and fix it but have no clue where to start. I guess the first step would be to consistently reproduce the bug...

I am not familiar with Chromium at all, and I also don't run Linux on the desktop as I'm guessing from your video you do (?) so take this with a grain of salt...

I would start looking at the focus and key event handlers. e.g. maybe log the contents of pressed_keys and/or step thru the code from the beginning of the focus handler. It looks like this might be the place:

https://github.com/chromium/chromium/blob/main/components/ex...

Var is somewhat controversial and shouldn’t be used indiscriminately anyway. Chromium’s Java styleguide is a good example: https://chromium.googlesource.com/chromium/src/+/main/styleg...

Looks like they added this in October 2013: https://github.com/chromium/chromium/commit/422c736b82e7ee76...

    Bundle Hangouts Services extension with Chrome

One of the unexpected use of shadow DOMs for me was a document generated for image resource URLs [1], because the HTML standard apparently specifies the exact DOM structure of the generated document except for the `` element [2].

[1] https://github.com/chromium/chromium/blob/f02ca73/third_part...

[2] https://html.spec.whatwg.org/multipage/document-lifecycle.ht...