Note: The aggregationCoordinatorOrigin field is needed for to select the coordinator, which is a major part of the functionality of the API. The long-term goal is to disallow setting privateAggregationConfig altogether inside of fenced frames. But for now, the usability hit is way too large to disable all of the fields. This will be revisited in the future when there are alternate ways to set the coordinator origin.
sharedStorage.run()accepts aprivateAggregationConfig(https://patcg-individual-drafts.github.io/private-aggregation-api/#dom-sharedstoragerunoperationmethodoptions-privateaggregationconfig) field, which allows settings to be passed in to be used when sending Private Aggregation reports. However, this can be used from within a fenced frame to exfiltrate information. Because of that, these fields must be completely disabled inside of fenced frames.Note: The
aggregationCoordinatorOriginfield is needed for to select the coordinator, which is a major part of the functionality of the API. The long-term goal is to disallow settingprivateAggregationConfigaltogether inside of fenced frames. But for now, the usability hit is way too large to disable all of the fields. This will be revisited in the future when there are alternate ways to set the coordinator origin.Preview | Diff