WPT
wpt / css / css-variables / variable-reference-name-substitution-attr-taint.html
Spec: CSS Variables ↗
Runs: Chrome 155.0.8038.0 (wpt@7addae031, 2026-09-02) | Firefox 157.0a1 (wpt@7addae031, 2026-09-02) | Safari 251 preview (wpt@5ce815a83, 2026-08-27) | Ladybird 1.0-a7884 (wpt@b1a7025f8, 2026-09-02) | Servo Servo 0.6 (wpt@09159dcb3, 2026-09-02) | Blitz 188486089 (wpt@a95401e4e, 2026-09-02)
View on the Blitz WPT dashboard | Open test on wpt.live | wpt.fyi
| Chrome | Firefox | Safari | Ladybird | Servo | Blitz | |
|---|---|---|---|---|---|---|
| Total | 6/9 | 6/9 | 9/9 | 4/9 | 6/9 | NOT RUN |
| Subtest | Chrome | Firefox | Safari | Ladybird | Servo | Blitz |
|---|---|---|---|---|---|---|
| attr()-tainted name argument makes an image-set() declaration invalid at computed-value time | PASS | PASS | PASS | PASS | PASS | — |
| attr()-tainted name argument taints a url() value | PASS | PASS | PASS | FAIL | PASS | — |
| attr()-taint reaches the name argument through another custom property | PASS | PASS | PASS | FAIL | PASS | — |
| attr()-tainted name argument taints the fallback | PASS | PASS | PASS | FAIL | PASS | — |
| attr()-tainted name argument taints a registered <url> property | PASS | PASS | PASS | FAIL | PASS | — |
| attr()-tainted name argument does not invalidate values that are not URLs | FAIL | FAIL | PASS | PASS | FAIL | — |
| attr()-tainted name argument substitutes normally into a custom property | FAIL | FAIL | PASS | PASS | FAIL | — |
| attr()-tainted name argument taints the value even when an earlier value was already tainted | PASS | PASS | PASS | FAIL | PASS | — |
| untainted substituted name argument does not taint the value | FAIL | FAIL | PASS | PASS | FAIL | — |