Dear Group, this is the output of the Security Review
Security review request: w3c/security-request#140
Reviewed version: https://www.w3.org/TR/2026/WD-css-image-animation-1-20260409/
Security and Privacy Questionnaire: #14164
Thank you for the explanation provided in the Security and Privacy Questionnaire.
I agree with the clarification requested in the Privacy review: w3cping/privacy-request#218
I also considered the following separate, non-blocking point.
Avoid coupling :animated-image matching to a global animation setting
Description: The specification says that, when a user-agent setting globally disables image animations, images that could otherwise be animated are considered static and do not match :animated-image. In an implementation following this rule, a page could test a known animated content image and infer whether the setting is active.
Impact: This would expose one bit of user-agent preference state.
Suggestions: Consider defining selector matching independently of the global setting and letting that setting affect rendering only. If the coupling is intentional, document the exposure.
Affected Sections:
Dear Group, this is the output of the Security Review
Security review request: w3c/security-request#140
Reviewed version: https://www.w3.org/TR/2026/WD-css-image-animation-1-20260409/
Security and Privacy Questionnaire: #14164
Thank you for the explanation provided in the Security and Privacy Questionnaire.
I agree with the clarification requested in the Privacy review: w3cping/privacy-request#218
I also considered the following separate, non-blocking point.
Avoid coupling
:animated-imagematching to a global animation settingDescription: The specification says that, when a user-agent setting globally disables image animations, images that could otherwise be animated are considered static and do not match
:animated-image. In an implementation following this rule, a page could test a known animated content image and infer whether the setting is active.Impact: This would expose one bit of user-agent preference state.
Suggestions: Consider defining selector matching independently of the global setting and letting that setting affect rendering only. If the coupling is intentional, document the exposure.
Affected Sections: