Bug 201952 – AX: VO can still access content that's inside a visibility:hidden iframe

• Status: NEW
• Component: Accessibility

[Diane Ko]

Created attachment 379083 [details]
Screencast of using VO to navigate to hidden iframe elements

iframe content that is hidden with visibility:hidden, and is meant to be hidden for all users, including AT users, can still be accessed with VoiceOver.

Steps to reproduce:
1. Turn on VoiceOver and open Safari
2. Access a page that has an iframe that either has visibility:hidden applied directly, or to its parent node (eg: https://codepen.io/backwardok/pen/YzKJOgM)
3. Navigate using VoiceOver to the content before the frame and then navigate forward

What's expected:
VoiceOver skips over the hidden frame and navigates to the next piece of content.

What happens:
VoiceOver accesses the frame, as well as allows a user to navigate inside the frame.

I was also able to reproduce this on an iPhone with VO and Safari.

When using VO on macOS with Firefox or Chrome, the frames are properly ignored. I also validated that using NVDA with Firefox also properly ignores the hidden iframe. TalkBack with Chrome also properly ignores the hidden iframe.

[Radar WebKit Bug Importer]

<rdar://problem/55497863>

[Mihira Jayasekera]

Created attachment 459683 [details]
Screencast of VoiceOver in iOS 15.5 incorrectly reading contents of hidden iframes

[Mihira Jayasekera]

This bug persists in macOS 12.4 and iOS 15.5 -- see attached screencast depicting the error in iOS 15.5. This defies common sense and the current WAI-ARIA 1.3 Editor's Draft (https://w3c.github.io/aria/#tree_exclusion), which states:

> The following elements are not exposed via the accessibility API and user agents MUST NOT include them in the accessibility tree:

> • Elements, including their descendent elements, that have host language semantics specifying that the element is not displayed, such as CSS display:none, visibility:hidden, or the HTML hidden attribute.