Add `<meta name="responsive-embedded-sizing">` by kojiishi · Pull Request #12444 · whatwg/html

kojiishi · 2026-05-13T08:54:08Z

This adds <meta name="responsive-embedded-sizing"> as an immutable standardized name.

This is used by the CSS responsive embedded sizing flag.

At least two implementers are interested (and none opposed):
- Chromium: https://chromestatus.com/feature/5108373464547328
Tests are written and can be reviewed and commented upon at:
- https://wpt.fyi/results/css/css-sizing/responsive-iframe?label=master&label=experimental&aligned
Implementation bugs are filed:
- Chromium: https://crbug.com/418397278
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=2039202
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=314714
Corresponding HTML AAM & ARIA in HTML issues & PRs: N/A
MDN issue is filed: In Chromium Documentation Tracker https://issuetracker.google.com/issues/511947520
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/browsing-the-web.html ( diff )
/dom.html ( diff )
/infrastructure.html ( diff )
/semantics.html ( diff )

kojiishi · 2026-05-13T09:37:20Z

@chrishtr @bfgeek @annevk @zcorpan

miketaylr · 2026-05-18T01:38:56Z

https://html.spec.whatwg.org/#the-meta-element

If either name, http-equiv, or itemprop is specified, then the content attribute must also be specified. Otherwise, it must be omitted.

But just below:

If a meta element has a name attribute, it sets document metadata.... If a meta element has no content attribute, then the value part of the metadata name-value pair is the empty string.

So meta with name and without content is allowed (but, imho it's a bit confusing for HTML to use must in "this must be specified, otherwise it must not be specified" instead of may?)

kojiishi · 2026-05-25T07:20:07Z

@annevk can you help whether the content attribute is required or not? It looks to me that omitting is allowed from what @miketaylr quoted, but I'm not sure.

@mtrootyy wrote:

If a meta element has no content attribute, then the value part of the metadata name-value pair is the empty string.

The above specifications are for user agents, not for authors. Regardless of how the user agent processes it, author must comply with the following specifications.

If either name, http-equiv, or itemprop is specified, then the content attribute must also be specified.

noamr

(Unofficial as I'm not an approver and we need multi implementer support)
I think this PR does the right thing in a way that's concise and consistent enough.
Editorially I can't say about maintaining the outdated wording style of existing meta tag or moving forward.

noamr · 2026-05-28T19:01:42Z

+    <div algorithm>
+    <p>If a <code>meta</code> element is
+    <span data-x="node is inserted into a document">inserted into the document</span>,
+    the user agent must run the following algorithm:</p>


I think this wording style is outdated but will leave to @annevk whether this needs to be consistent with what's around it or with new style.

OK I looked at other meta elements and you need to check for the name here. Are you ignoring the content? If so it's good to add a note.
Does changing the name attribute work? Is the matching case-sensitive?

Follow based on how other meta elements are speced.

Thanks again, I read others and followed them. Can you check?

noamr · 2026-06-02T10:43:32Z

@kojiishi the tests link points to existing tests in wpt.fyi that are not marked tentative.
Is there good coverage for adding/removing the meta tag dynamically before is seen?

kojiishi · 2026-06-03T05:18:54Z

@noamr

the tests link points to existing tests in wpt.fyi that are not marked tentative.

I removed .tentative because the template of this PR requested me to do so, there's a CSS WG resolution, and the resolution is put in the CSS spec. With this discussion, I will make sure the CSS spec is updated. Was that too early?

Is there good coverage for adding/removing the meta tag dynamically before is seen?

Yes, I think so, though they're based on the previous understanding of the "immutable" in the CSS WG. Among the wpt tests:

meta-in-body tests <meta> appearing in <body>.
meta-afterr-head tests <meta> in after-head insertion mode.
dynamic-append tests appending <meta>.
dynamic-remove tests removing <meta>.
dynamic-write tests document.write.
dynamic-name-change tests changing the name attribute.

I'll update/add tests and Blink once this discussion is settled down.

noamr · 2026-06-03T13:00:01Z

+    <div algorithm>
+    <p>If a <code>meta</code> element is
+    <span data-x="node is inserted into a document">inserted into the document</span>,
+    the user agent must run the following algorithm:</p>


OK I looked at other meta elements and you need to check for the name here. Are you ignoring the content? If so it's good to add a note.
Does changing the name attribute work? Is the matching case-sensitive?

Follow based on how other meta elements are speced.

noamr · 2026-06-11T09:41:38Z

WHATNOT notes/minutes:

Responsive Iframe Meta Tag Proposal: Noam Rosenthal introduced a proposal (PR 12444) to add a meta tag for responsive embedded sizing, which serves as an opt-in for parents to resize iframes. Luke questioned if domain-specific opt-ins are necessary, but Simon Pieters noted that CSP frame ancestors already provide existing protections. The group discussed whether the meta tag provides sufficient control over cross-origin information access, with Noam Rosenthal comparing the functionality to an explicit post-message opt-in.

Responsive Iframe Data Leakage Concerns: The group discussed potential privacy risks, specifically whether responsive iframes could allow an origin to infer information about a user (e.g., whether they are logged into a site) based on size changes. Emilio Cobos Álvarez noted that the CSS working group previously discussed these risks and deemed them manageable if the parent page manages the sizing. Simon Pieters raised concerns regarding how to handle navigations and potential data leakage between pages.

Responsive Iframe Implementation and Documentation: Luke suggested that browsers should provide console warnings if an iframe opts into this feature without appropriate frame ancestor restrictions. Noam Rosenthal committed to updating the security explainer for the PR and consulting with Koji to ensure privacy concerns are addressed. Philip Jägenstedt clarified that fence frames, while still present in Chromium code, are not currently being actively developed.

kojiishi · 2026-07-13T05:43:34Z

I got another feedback from our security folks to add allowed-origin attribute. The value syntax is similar to frame-ancestors, but also allows wildcard. Examples:

<meta name="responsive-embedded-sizing" allowed-origins="https://example.org/ https://example2.org/">
<meta name="responsive-embedded-sizing" allowed-origins="*">

/cc @emilio @smfr

This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8

This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8084061 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1663715}

This patch renames the attribute as per the WHATWG feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I185e7e7de5411bbfe5d1a6a1c972e05dba49101d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8173946 Auto-Submit: Koji Ishii <kojii@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1673080} Co-authored-by: Koji Ishii <kojii@chromium.org>

…bute, a=testonly Automatic update from web-platform-tests [iframe] Support `allowed-origins` attribute (#61344) This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8084061 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1663715} Co-authored-by: Koji Ishii <kojii@chromium.org> -- wpt-commits: f1401e8ac6cac0cbe6f3008fbbc0edafd73b9d34 wpt-pr: 61344

For specifying the allowed origins, instead of adding a new attribute, as per the feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I78705424dd480737e1204f54e880a86071525c6d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8211759 Auto-Submit: Koji Ishii <kojii@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1674776} Co-authored-by: Koji Ishii <kojii@chromium.org>

…loworigins`, a=testonly Automatic update from web-platform-tests [iframe] Rename `allowed-origins` to `alloworigins` (#61725) This patch renames the attribute as per the WHATWG feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I185e7e7de5411bbfe5d1a6a1c972e05dba49101d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8173946 Auto-Submit: Koji Ishii <kojii@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1673080} Co-authored-by: Koji Ishii <kojii@chromium.org> -- wpt-commits: 5e75769b378a7ebf3831c0f3e73042518c7f8209 wpt-pr: 61725

…testonly Automatic update from web-platform-tests [iframe] Use the `content` attribute (#61797) For specifying the allowed origins, instead of adding a new attribute, as per the feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I78705424dd480737e1204f54e880a86071525c6d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8211759 Auto-Submit: Koji Ishii <kojii@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1674776} Co-authored-by: Koji Ishii <kojii@chromium.org> -- wpt-commits: b47d3bcbff5bbe2ed05253056c244d3dab686c36 wpt-pr: 61797

kojiishi · 2026-08-12T16:02:55Z

@zcorpan:

Yea that's probably better, like <meta name=viewport content="width=device-width"> we can have <meta name="responsive-embedded-sizing" content="alloworigins=*"> It allows us to extend in the future without adding new attributes to meta`.

Or even content="*". If more metadata is needed in the future, that can be added in new attributes.

Discussing this point with our security folks turned out that they think content="*" is too weak to let authors think about this is a security protection. They're fine with content="allow-origins=*".

Are you good with content="allow-origins=*"?

zcorpan · 2026-08-18T08:12:56Z

@kojiishi OK.

kojiishi · 2026-08-26T14:19:54Z

@kojiishi OK.

Thank you @zcorpan, this PR is updated to content="allow-origins=*". Also added an example, use tri-state defind in infra (null instead of unset), and a few cleanups.

This patch changes the `content` attribute of the `<meta>` element whose name is `responsive-embedded-sizing` to require the `allow-origins=` prefix, as discussed at [1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I56c233c72ed8cdefad347cddc842d0e8904f3598 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8293941 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1686940}

This patch changes the `content` attribute of the `<meta>` element whose name is `responsive-embedded-sizing` to require the `allow-origins=` prefix, as discussed at [1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I56c233c72ed8cdefad347cddc842d0e8904f3598 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8293941 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1686940} Co-authored-by: Koji Ishii <kojii@chromium.org>

…, a=testonly Automatic update from web-platform-tests [iframe] Require `allow-origins=` prefix (#62229) This patch changes the `content` attribute of the `<meta>` element whose name is `responsive-embedded-sizing` to require the `allow-origins=` prefix, as discussed at [1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I56c233c72ed8cdefad347cddc842d0e8904f3598 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8293941 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1686940} Co-authored-by: Koji Ishii <kojii@chromium.org> -- wpt-commits: 2beef90fd2b8d267ebed384b0edc7f59f309f991 wpt-pr: 62229

css-meeting-bot · 2026-09-03T15:09:15Z

The CSS Working Group just discussed Add `<meta name="responsive-embedded-sizing">` .

The full IRC log of that discussion

<keithamus> astearns: a PR from Koji
<keithamus> astearns: I did not look through to see who added it to our agenda
<keithamus> masonf: Noam
<keithamus> astearns: who is not here. Anything we can do, or shall we push until Noam is on the call?
<keithamus> masonf: PR with comments from a few days ago. I say we keep it on agenda for next week
<keithamus> astearns: skipped.

This adds `<meta name="responsive-embedded-sizing">` as an immutable standardized name. This is used by the CSS [responsive embedded sizing flag]. [responsive embedded sizing flag]: https://drafts.csswg.org/css-sizing-4/#document-responsive-embedded-sizing-flag

For specifying the allowed origins, instead of adding a new attribute, as per the feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I78705424dd480737e1204f54e880a86071525c6d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8211759 Auto-Submit: Koji Ishii <kojii@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1674776}

This patch changes the `content` attribute of the `<meta>` element whose name is `responsive-embedded-sizing` to require the `allow-origins=` prefix, as discussed at [1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I56c233c72ed8cdefad347cddc842d0e8904f3598 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8293941 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1686940}

noamr · 2026-10-13T17:35:18Z

AI Review

Reviewed at 8fd9d89. The algorithm reads cleanly and all cross-references resolve (starts with, set create, split on ASCII whitespace, serialization of an origin, the two new CSP imports, refsCSSSIZING). It mirrors the referrer processing model and the CSP frame-ancestors navigation response check closely, which is the right template. Remaining points, roughly in order of importance:

Cross-spec consistency with css-sizing-4

The CSS side (§ HTML iframe details) currently disagrees with this PR in four ways, and I think at least (3) is new since the last round:

When the flag becomes false — CSS: "if the body element is opened … during the initial document parse"; here: on reveal. (Known; already discussed.)
CSS calls the third state "unset", here it's null; and CSS defines its own Document/responsive embedded sizing flag, which should become a reference to the exported HTML dfn once this lands.
CSS says <meta name=responsive-embedded-sizing> alone opts in (its example at L1305 has no content). Under this PR, a meta with no content, or a content not starting with allow-origins=, is a no-op, so the CSS example never opts in. Worth calling out explicitly in the CSSWG follow-up, since it's an author-visible change in the opt-in syntax, not just a timing refinement.
requestResize() throws when the flag is "unset or false" — fine with this PR, just needs the terminology sync.

Suggest linking the csswg-drafts PR from the OP so they land together.

What "reveal" implies for the opt-in window

reveal runs from update the rendering only for docs that survive "Filter non-renderable documents" and "Unnecessary rendering" — so a document in a hidden tab, a prerendered document, a render-blocked document, or one the UA chooses to skip is never revealed until that changes. Consequences:

Script can set the flag to true arbitrarily late in such documents (after body, after load), unlike the parse-bounded rule in CSS.
CSS reads the flag "when it performs a layout"; forced layouts (e.g. getBoundingClientRect()) can run before reveal, so CSS will observe a null→true transition after layouts have already happened. That's probably fine given the ICB lock is only recorded when the flag is true, but it should be a conscious decision and the CSS text ("will not change its value again") updated to match.
document.open() doesn't reset the flag (nor has been revealed), so a re-opened document keeps the earlier true/false. Consistent with the revealed design; just confirming it's intended.

None of this is necessarily wrong — it is consistent with how render-blocking is bounded — but the PR description/commit message should state the model ("fixed at first rendering update") since it's the thing implementers will test against. @zcorpan's thread about resetting the locked embedded ICB size on navigation still looks open; that's a CSS-side formalization but is the other half of the leak argument.

`'self'` / `'none'` semantics

sourceList is matched with document's origin as the CSP origin argument, so 'self' means "embedder is same-origin with this document". That's a sensible meaning but nothing in the authoring text says so; ancestor-source-list also admits 'none', which here is just a verbose way to not opt in. Suggest a sentence in the <dd> (and perhaps a second example) spelling out 'self'.

Content value robustness

starts with "allow-origins=" is case-sensitive and whitespace-sensitive. Other standard metadata names are tolerant (referrer lowercases; color-scheme/theme-color go through CSS parsing with whitespace skipping). At minimum, I'd strip leading and trailing ASCII whitespace from value before the prefix check — content=" allow-origins=…" silently failing is a footgun. Whether the key is case-insensitive should be stated either way.
Is allow-origins= intended to be the only key forever? If future keys are plausible, defining the value as whitespace- or ;-separated key=value tokens now avoids a breaking parse change later. Question, not a blocker.

Editorial

Document section: "set to false when revealing the Document" → "set to false, if still null, when revealing…" to match the step.
"allows a document to opt in to responsively-sized iframes when embedded by an allowed container origin" — the subject is the embedded document; maybe "allows a document, when embedded in an iframe by a page from one of the listed origins, to opt in to being responsively sized."
The conformance paragraph "There must not be more than one meta element … per document" — "per document" reads oddly at the end; the theme-color wording ("There must not be more than one meta element with its name attribute set to … per document") puts it the same way, so fine to keep for consistency.
tokens holds a list after splitting; "Let tokens be the substring of value …, split on ASCII whitespace" is OK but "Let tokens be the result of splitting the code unit substring of value from the length of "allow-origins=" to the end on ASCII whitespace" is closer to how Infra phrases it. Nit.
Example <pre> continuation line is indented 6 spaces inside the <code>; that whitespace renders. Compare the single-line theme-color examples.

…bute, a=testonly Automatic update from web-platform-tests [iframe] Support `allowed-origins` attribute (#61344) This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8084061 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1663715} Co-authored-by: Koji Ishii <kojii@chromium.org> -- wpt-commits: f1401e8ac6cac0cbe6f3008fbbc0edafd73b9d34 wpt-pr: 61344

…loworigins`, a=testonly Automatic update from web-platform-tests [iframe] Rename `allowed-origins` to `alloworigins` (#61725) This patch renames the attribute as per the WHATWG feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I185e7e7de5411bbfe5d1a6a1c972e05dba49101d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8173946 Auto-Submit: Koji Ishii <kojii@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1673080} Co-authored-by: Koji Ishii <kojii@chromium.org> -- wpt-commits: 5e75769b378a7ebf3831c0f3e73042518c7f8209 wpt-pr: 61725

…testonly Automatic update from web-platform-tests [iframe] Use the `content` attribute (#61797) For specifying the allowed origins, instead of adding a new attribute, as per the feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I78705424dd480737e1204f54e880a86071525c6d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8211759 Auto-Submit: Koji Ishii <kojii@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1674776} Co-authored-by: Koji Ishii <kojii@chromium.org> -- wpt-commits: b47d3bcbff5bbe2ed05253056c244d3dab686c36 wpt-pr: 61797

…, a=testonly Automatic update from web-platform-tests [iframe] Require `allow-origins=` prefix (#62229) This patch changes the `content` attribute of the `<meta>` element whose name is `responsive-embedded-sizing` to require the `allow-origins=` prefix, as discussed at [1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I56c233c72ed8cdefad347cddc842d0e8904f3598 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8293941 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1686940} Co-authored-by: Koji Ishii <kojii@chromium.org> -- wpt-commits: 2beef90fd2b8d267ebed384b0edc7f59f309f991 wpt-pr: 62229

kojiishi force-pushed the responsive-embedded-sizing branch from 4f63023 to 5d63e86 Compare May 13, 2026 09:09

kojiishi mentioned this pull request May 13, 2026

Responsively-sized iframes mozilla/standards-positions#1394

Open

This comment was marked as resolved.

Sign in to view

annevk reviewed May 18, 2026

View reviewed changes

Comment thread source Outdated

kojiishi force-pushed the responsive-embedded-sizing branch from 5d63e86 to ad98ae3 Compare May 28, 2026 08:51

noamr reviewed May 28, 2026

View reviewed changes

Comment thread source Outdated

Comment thread source Outdated

Comment thread source Outdated

kojiishi force-pushed the responsive-embedded-sizing branch from ad98ae3 to 49c5445 Compare May 28, 2026 16:22

noamr reviewed May 28, 2026

View reviewed changes

Comment thread source Outdated

kojiishi force-pushed the responsive-embedded-sizing branch 2 times, most recently from fe4fc74 to 615fb1c Compare May 28, 2026 17:34

noamr approved these changes May 28, 2026

View reviewed changes

noamr reviewed Jun 3, 2026

View reviewed changes

noamr self-requested a review June 3, 2026 13:00

kojiishi force-pushed the responsive-embedded-sizing branch from 615fb1c to 6404dc1 Compare June 5, 2026 17:59

mtrootyy reviewed Jun 5, 2026

View reviewed changes

Comment thread source

annevk mentioned this pull request Jul 3, 2026

[css-sizing] Auto-resize iframes based on content w3c/csswg-drafts#1771

Open

kojiishi force-pushed the responsive-embedded-sizing branch from 6404dc1 to 43cbcf8 Compare July 13, 2026 06:21

noamr reviewed Jul 13, 2026

View reviewed changes

Comment thread source Outdated

kojiishi force-pushed the responsive-embedded-sizing branch from 43cbcf8 to 89778a0 Compare July 13, 2026 10:29

chromium-wpt-export-bot mentioned this pull request Jul 16, 2026

[iframe] Support allowed-origins attribute web-platform-tests/wpt#61344

Merged

chromium-wpt-export-bot mentioned this pull request Aug 6, 2026

[iframe] Use the content attribute web-platform-tests/wpt#61797

Merged

kojiishi force-pushed the responsive-embedded-sizing branch from e805016 to 093def9 Compare August 10, 2026 09:42

zcorpan mentioned this pull request Aug 24, 2026

Add sandbox permission to allow native drag-and-drop between sandboxed/cross-origin iframes and parent #12807

Open

mfreed7 mentioned this pull request Aug 25, 2026

Meeting 49 for joint OpenUI-WHATWG/HTML-CSSWG task force on styleable form controls #12841

Closed

kojiishi force-pushed the responsive-embedded-sizing branch from 093def9 to 1d50e5d Compare August 26, 2026 14:16

noamr reviewed Aug 26, 2026

View reviewed changes

Comment thread source Outdated

Comment thread source Outdated

Comment thread source

Comment thread source Outdated

Comment thread source Outdated

Comment thread source Outdated

chromium-wpt-export-bot mentioned this pull request Aug 27, 2026

[iframe] Require allow-origins= prefix web-platform-tests/wpt#62229

Merged

kojiishi force-pushed the responsive-embedded-sizing branch from 1d50e5d to e8e002b Compare August 31, 2026 08:35

mfreed7 mentioned this pull request Sep 3, 2026

Meeting 50 for joint OpenUI-WHATWG/HTML-CSSWG task force on styleable form controls #12900

Closed

kojiishi force-pushed the responsive-embedded-sizing branch from e8e002b to 8fd9d89 Compare September 10, 2026 18:23

Conversation

kojiishi commented May 13, 2026 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kojiishi commented May 13, 2026

Uh oh!

This comment was marked as resolved.

miketaylr commented May 18, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

kojiishi commented May 25, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

noamr left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

noamr May 28, 2026

Choose a reason for hiding this comment

Uh oh!

noamr Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

kojiishi Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

noamr commented Jun 2, 2026

Uh oh!

kojiishi commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

noamr Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

noamr commented Jun 11, 2026

Uh oh!

kojiishi commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kojiishi commented Aug 12, 2026

Uh oh!

zcorpan commented Aug 18, 2026

Uh oh!

kojiishi commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

css-meeting-bot commented Sep 3, 2026

Uh oh!

noamr commented Oct 13, 2026

Cross-spec consistency with css-sizing-4

What "reveal" implies for the opt-in window

'self' / 'none' semantics

Content value robustness

Editorial

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

9 participants

kojiishi commented May 13, 2026 •

edited by pr-preview Bot

Loading

noamr left a comment •

edited

Loading

kojiishi commented Jun 3, 2026 •

edited

Loading

kojiishi commented Jul 13, 2026 •

edited

Loading

kojiishi commented Aug 26, 2026 •

edited

Loading

`'self'` / `'none'` semantics