top secret fam. DO NOT SHARE EXTERNALLY.
the little window that opens up from the Electrobun Kitchen Sink *does not contain a webview*.
- no dom
- no cssom
- just a native window
- with direct access to webgpu/metal
- three.js api layered on top
- directly in bun typescript
the little window that opens up from the Electrobun Kitchen Sink *does not contain a webview*.
- no dom
- no cssom
- just a native window
- with direct access to webgpu/metal
- three.js api layered on top
- directly in bun typescript
February 28, 2026 at 1:01 AM
top secret fam. DO NOT SHARE EXTERNALLY.
the little window that opens up from the Electrobun Kitchen Sink *does not contain a webview*.
- no dom
- no cssom
- just a native window
- with direct access to webgpu/metal
- three.js api layered on top
- directly in bun typescript
the little window that opens up from the Electrobun Kitchen Sink *does not contain a webview*.
- no dom
- no cssom
- just a native window
- with direct access to webgpu/metal
- three.js api layered on top
- directly in bun typescript
Blink: Intent to Prototype: CSSOM Document.nodesFromRect API
Blink: Intent to Prototype: CSSOM Document.nodesFromRect API
Blink: Intent to Prototype: CSSOM Document.nodesFromRect API
groups.google.com
September 18, 2025 at 4:53 PM
Blink: Intent to Prototype: CSSOM Document.nodesFromRect API
And why did this happen? Defensively, browsers will not run any synchronous JS if any synchronous CSS is still in flight. This is because the JS could read/write from/to the CSSOM, so the browser will build the CSSOM first, just in case.
February 7, 2025 at 11:21 AM
And why did this happen? Defensively, browsers will not run any synchronous JS if any synchronous CSS is still in flight. This is because the JS could read/write from/to the CSSOM, so the browser will build the CSSOM first, just in case.
CVE-2026-93752 CSSOM DoS: setProperty() fails to validate reserved names, so a stylesheet declaring "length" wrecks the internal counter and blows up memory during cssText serialization. CVSS 7.5, no patch yet. Audit your CSS tooling now. https://www.valtersit.com/cve/CVE-2026-93752/ #CVE #infosec
CVE-2026-93752 Denial of Service in CSSOM
www.valtersit.com
September 25, 2026 at 5:30 AM
CVE-2026-93752 CSSOM DoS: setProperty() fails to validate reserved names, so a stylesheet declaring "length" wrecks the internal counter and blows up memory during cssText serialization. CVSS 7.5, no patch yet. Audit your CSS tooling now. https://www.valtersit.com/cve/CVE-2026-93752/ #CVE #infosec
good morning CSSOM (🎂 edition)
December 17, 2024 at 4:57 PM
good morning CSSOM (🎂 edition)
The Process of Shipping The CSS Media Pseudo Classes Polyfill | My first polyfill 🙌 - Thank you @jamessw.com for the inspiration. This post covers what shipped, what I learned about the CSSOM and unsupported CSS, how you can try it, and what comes next. | schalkneethling.com/posts/the-pr...
The Process of Shipping The CSS Media Pseudo Classes Polyfill
The CSS Media Pseudo Classes Polyfill is now available on npm. This post covers what shipped, what I learned about the CSSOM and unsupported CSS, how you can try it, and what comes next."
schalkneethling.com
April 7, 2026 at 7:00 PM
The Process of Shipping The CSS Media Pseudo Classes Polyfill | My first polyfill 🙌 - Thank you @jamessw.com for the inspiration. This post covers what shipped, what I learned about the CSSOM and unsupported CSS, how you can try it, and what comes next. | schalkneethling.com/posts/the-pr...
Her last name is also Hannah. 😂 The Sarah’s and Hannah’s. And his last name is Marcus. From CSSoM. I have not seen this movie, but it seems so ridiculous.
December 2, 2024 at 6:59 PM
Her last name is also Hannah. 😂 The Sarah’s and Hannah’s. And his last name is Marcus. From CSSoM. I have not seen this movie, but it seems so ridiculous.
I've come to the sad conclusion that @apply in Tailwind is a big anti-pattern.
With enough complex utilities, your CSS can balloon to hundreds of kB, bloating the CSSOM and hurting runtime rendering performance, not just network.
With enough complex utilities, your CSS can balloon to hundreds of kB, bloating the CSSOM and hurting runtime rendering performance, not just network.
February 21, 2026 at 3:19 PM
I've come to the sad conclusion that @apply in Tailwind is a big anti-pattern.
With enough complex utilities, your CSS can balloon to hundreds of kB, bloating the CSSOM and hurting runtime rendering performance, not just network.
With enough complex utilities, your CSS can balloon to hundreds of kB, bloating the CSSOM and hurting runtime rendering performance, not just network.
CSSOM: A #CSS Parser Written in Pure #JavaScript — Also a partial implementation of CSS Object Model || #WebDev bit.ly/4ixqrK9
GitHub - acemir/CSSOM: CSS Object Model implemented in pure JavaScript. Also, a CSS parser.
CSS Object Model implemented in pure JavaScript. Also, a CSS parser. - acemir/CSSOM
bit.ly
December 2, 2025 at 10:00 PM
CSSOM: A #CSS Parser Written in Pure #JavaScript — Also a partial implementation of CSS Object Model || #WebDev bit.ly/4ixqrK9
github.com/w3c/csswg-dr...
Call to action for #WebComponent / #ShadowDOM fans: I've added an experimental flag to Firefox lifting the restriction on adoptedStyleSheets, meaning shadowroots can adopt `link.sheet` or `style.sheet`.
Please try this out, and let me know if you encounter issues!
Call to action for #WebComponent / #ShadowDOM fans: I've added an experimental flag to Firefox lifting the restriction on adoptedStyleSheets, meaning shadowroots can adopt `link.sheet` or `style.sheet`.
Please try this out, and let me know if you encounter issues!
[cssom] Can we lift the restriction on constructed flag for adoptedStylesheets? · Issue #10013 · w3c/csswg-drafts
Currently adoptedStyleSheets has a restriction on CSSStyleSheets that have the constructed flag set: The set an indexed value algorithm for adoptedStyleSheets, given value and index, is the followi...
github.com
January 31, 2025 at 12:49 PM
github.com/w3c/csswg-dr...
Call to action for #WebComponent / #ShadowDOM fans: I've added an experimental flag to Firefox lifting the restriction on adoptedStyleSheets, meaning shadowroots can adopt `link.sheet` or `style.sheet`.
Please try this out, and let me know if you encounter issues!
Call to action for #WebComponent / #ShadowDOM fans: I've added an experimental flag to Firefox lifting the restriction on adoptedStyleSheets, meaning shadowroots can adopt `link.sheet` or `style.sheet`.
Please try this out, and let me know if you encounter issues!
Blink: Intent to Prototype: CSSOM View geometry utilities
Blink: Intent to Prototype: CSSOM View geometry utilities
Blink: Intent to Prototype: CSSOM View geometry utilities
groups.google.com
July 7, 2026 at 8:06 PM
Blink: Intent to Prototype: CSSOM View geometry utilities
i open tiktok this is the first comment 😐 it’s under a CSSOM eras tour performance
March 16, 2025 at 8:51 AM
i open tiktok this is the first comment 😐 it’s under a CSSOM eras tour performance
I forgot to mention earlier that Javascript's CSSOM library (in browsers by default) has a CSS.escape method which deals with this:
> CSS.escape('123') // => "\31 23"
But actually trying to use this in practice makes your Javascript feel as clunky as your CSS is.
> CSS.escape('123') // => "\31 23"
But actually trying to use this in practice makes your Javascript feel as clunky as your CSS is.
November 15, 2024 at 8:39 PM
I forgot to mention earlier that Javascript's CSSOM library (in browsers by default) has a CSS.escape method which deals with this:
> CSS.escape('123') // => "\31 23"
But actually trying to use this in practice makes your Javascript feel as clunky as your CSS is.
> CSS.escape('123') // => "\31 23"
But actually trying to use this in practice makes your Javascript feel as clunky as your CSS is.
fastmail gotta have one of the most responsive bug bounties out there
i've previously had my vulns fixed in <36h and now i submitted another bug and that was fixed in 6h??
they also sponsor dompurify's bug bounty so that's cool as fuck
and they have the most fun css sanitiser!
i've previously had my vulns fixed in <36h and now i submitted another bug and that was fixed in 6h??
they also sponsor dompurify's bug bounty so that's cool as fuck
and they have the most fun css sanitiser!
September 20, 2025 at 7:38 AM
fastmail gotta have one of the most responsive bug bounties out there
i've previously had my vulns fixed in <36h and now i submitted another bug and that was fixed in 6h??
they also sponsor dompurify's bug bounty so that's cool as fuck
and they have the most fun css sanitiser!
i've previously had my vulns fixed in <36h and now i submitted another bug and that was fixed in 6h??
they also sponsor dompurify's bug bounty so that's cool as fuck
and they have the most fun css sanitiser!
What exactly is the viewport? 🔍
The CSSOM View Module defines key concepts like the visual & layout viewport, and initial containing block, and understanding them is essential for responsiveness, scrolling, and positioning correctly.
Master viewport 👇
developer.mozilla.org/en-US/docs/...
The CSSOM View Module defines key concepts like the visual & layout viewport, and initial containing block, and understanding them is essential for responsiveness, scrolling, and positioning correctly.
Master viewport 👇
developer.mozilla.org/en-US/docs/...
Viewport concepts - CSS | MDN
This article explains the concept of the viewport — what it is, its impact in terms of CSS, SVG, and mobile devices — and differentiates between the visual viewport and the layout viewport.
developer.mozilla.org
September 5, 2025 at 3:00 AM
What exactly is the viewport? 🔍
The CSSOM View Module defines key concepts like the visual & layout viewport, and initial containing block, and understanding them is essential for responsiveness, scrolling, and positioning correctly.
Master viewport 👇
developer.mozilla.org/en-US/docs/...
The CSSOM View Module defines key concepts like the visual & layout viewport, and initial containing block, and understanding them is essential for responsiveness, scrolling, and positioning correctly.
Master viewport 👇
developer.mozilla.org/en-US/docs/...
Your browser is doing WAY more than just displaying HTML.
New video:
How Browsers Actually Render Web Pages
www.youtube.com/watch?v=h5h1...
#RenderTree #CSSOM #BrowserRendering #WebDevelopment #JavaScript #Coding
New video:
How Browsers Actually Render Web Pages
www.youtube.com/watch?v=h5h1...
#RenderTree #CSSOM #BrowserRendering #WebDevelopment #JavaScript #Coding
How the Browser Actually Renders a Web Page
YouTube video by AutistiCoder
www.youtube.com
May 12, 2026 at 8:15 PM
Your browser is doing WAY more than just displaying HTML.
New video:
How Browsers Actually Render Web Pages
www.youtube.com/watch?v=h5h1...
#RenderTree #CSSOM #BrowserRendering #WebDevelopment #JavaScript #Coding
New video:
How Browsers Actually Render Web Pages
www.youtube.com/watch?v=h5h1...
#RenderTree #CSSOM #BrowserRendering #WebDevelopment #JavaScript #Coding
ya, `getComputedStyled` is CSSOM, while `computedStyleMap()` is Typed CSSOM and therefore newer/not quite baseline.
June 19, 2025 at 1:07 AM
ya, `getComputedStyled` is CSSOM, while `computedStyleMap()` is Typed CSSOM and therefore newer/not quite baseline.
"Hit testing will hopefully be defined in a future revision of CSS or HTML." - 4 August 2011
www.w3.org/TR/2011/WD-c...
www.w3.org/TR/2011/WD-c...
CSSOM View Module
www.w3.org
October 6, 2025 at 6:49 PM
"Hit testing will hopefully be defined in a future revision of CSS or HTML." - 4 August 2011
www.w3.org/TR/2011/WD-c...
www.w3.org/TR/2011/WD-c...
CVE-2026-93752 - CSSOM through 0.5.0 Denial of Service via length Property
CVE ID : CVE-2026-93752
Published : Sept. 18, 2026, 6:18 p.m. | 21 minutes ago
Description : CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() tha...
CVE ID : CVE-2026-93752
Published : Sept. 18, 2026, 6:18 p.m. | 21 minutes ago
Description : CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() tha...
CVE-2026-93752 - CSSOM through 0.5.0 Denial of Service via length Property
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.
cvefeed.io
September 18, 2026 at 7:09 PM
CVE-2026-93752 - CSSOM through 0.5.0 Denial of Service via length Property
CVE ID : CVE-2026-93752
Published : Sept. 18, 2026, 6:18 p.m. | 21 minutes ago
Description : CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() tha...
CVE ID : CVE-2026-93752
Published : Sept. 18, 2026, 6:18 p.m. | 21 minutes ago
Description : CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() tha...
that’s a cool concept! does it programmatically translate from dom to cssom names, or is it a limited set of style props with themable defaults for the others?
July 22, 2024 at 8:27 PM
that’s a cool concept! does it programmatically translate from dom to cssom names, or is it a limited set of style props with themable defaults for the others?
Major update to the CSS Media Queries Analysis Snippet with a Performance Impact Analyzer
It calculates the REAL cost of desktop-only CSS on mobile:
📉 Core Web Vitals Impact
💰 Estimated Conversion Lift
e.g.: Fixing 30KB of unused CSS 180ms faster load and up to 1.8% conversion boost
It calculates the REAL cost of desktop-only CSS on mobile:
📉 Core Web Vitals Impact
💰 Estimated Conversion Lift
e.g.: Fixing 30KB of unused CSS 180ms faster load and up to 1.8% conversion boost
December 16, 2025 at 9:07 AM
Major update to the CSS Media Queries Analysis Snippet with a Performance Impact Analyzer
It calculates the REAL cost of desktop-only CSS on mobile:
📉 Core Web Vitals Impact
💰 Estimated Conversion Lift
e.g.: Fixing 30KB of unused CSS 180ms faster load and up to 1.8% conversion boost
It calculates the REAL cost of desktop-only CSS on mobile:
📉 Core Web Vitals Impact
💰 Estimated Conversion Lift
e.g.: Fixing 30KB of unused CSS 180ms faster load and up to 1.8% conversion boost
Oh my sweet summer child. 😅
Here is a sampling of failed attempts to do so:
github.com/w3c/csswg-dr...
discourse.wicg.io/t/observe-cu...
github.com/w3c/css-houd...
github.com/w3c/css-houd...
Here is a sampling of failed attempts to do so:
github.com/w3c/csswg-dr...
discourse.wicg.io/t/observe-cu...
github.com/w3c/css-houd...
github.com/w3c/css-houd...
[cssom] `ComputedStyleObserver` to observe changes in elements' computed styles · Issue #8982 · w3c/csswg-drafts
We need an API to observe computed style changes. One example use case is to update canvas rendering based on changes in computed styles of an element (f.e. transform values to determine where to d...
github.com
February 12, 2025 at 8:38 PM
Oh my sweet summer child. 😅
Here is a sampling of failed attempts to do so:
github.com/w3c/csswg-dr...
discourse.wicg.io/t/observe-cu...
github.com/w3c/css-houd...
github.com/w3c/css-houd...
Here is a sampling of failed attempts to do so:
github.com/w3c/csswg-dr...
discourse.wicg.io/t/observe-cu...
github.com/w3c/css-houd...
github.com/w3c/css-houd...
Another one of those things that would be great to have in the CSSOM.
July 28, 2026 at 1:32 PM
Another one of those things that would be great to have in the CSSOM.
It was surprisingly easy to implement because the spec is very well written: it’s a bunch of algorithms that you “simply” have to convert to code.
The more difficult parts were the CSSOM and Promises integration because you –by default– can’t do certain things with them.
Took me ±8 hours in total.
The more difficult parts were the CSSOM and Promises integration because you –by default– can’t do certain things with them.
Took me ±8 hours in total.
May 9, 2025 at 8:39 PM
It was surprisingly easy to implement because the spec is very well written: it’s a bunch of algorithms that you “simply” have to convert to code.
The more difficult parts were the CSSOM and Promises integration because you –by default– can’t do certain things with them.
Took me ±8 hours in total.
The more difficult parts were the CSSOM and Promises integration because you –by default– can’t do certain things with them.
Took me ±8 hours in total.