Do not perform default action on un-trusted events

DOM

According to the UI Events specification un-trusted events (i.e. those created by JavaScript) should not invoke the default action. 'click' is the only event that is a legacy permitted case. The isTrusted support was added in https://www.chromestatus.com/features/6461137440735232 which identifies trusted events from un-trusted events. We wish to prevent synthetic events from executing the default action, aligning with Firefox and IE.

Specification

Working draft or equivalent

Status in Chromium

Blink


Enabled by default (launch bug) in:

  • Chrome for desktop release 53
  • Chrome for Android release 53
  • Chrome for iOS release 53
  • Opera release 40
  • Opera for Android release 40

Consensus & Standardization

  • Shipped
  • Public support
  • No public signals
  • No signals

Owner

Last updated on 2017-06-14