A research team discovered a vulnerability in ChatGPT's share and HTML Preview features that let attackers run malicious JavaScript inside a victim's authenticated chatgpt.com session simply by sending them a link. Once opened, the code could read the victim's private conversations and call ChatGPT's authenticated APIs on their behalf, effectively taking over the account without any further action from the victim. OpenAI fixed the issue on October 26 and classified it as a P1 (critical) vulnerability.
parameter.ai
· 2026-10-31
Google engineers Thomas Nattestad and Natalia Markoborodova announced an experimental HTML-in-Canvas API, now available via origin trial, that lets developers draw DOM content directly into a 2D canvas or a WebGL/WebGPU texture. The API aims to keep that embedded UI interactable and accessible while retaining browser features such as text selection, translate, dark mode and autofill.
developer.chrome.com
· 2026-10-22
A developer who has worked across PHP, Python and Perl web stacks describes building a templating system for the Zig programming language, aimed at generating HTML without runtime errors or memory leaks. The approach uses Zig's compile-time features and arena allocators to check template inputs at compile time, auto-escape output to prevent XSS, and write directly to a writer without extra allocations. The project follows the author's earlier Zig libraries zio and Dusty, and was inspired after encountering an existing project called Ziex.
lalinsky.com
· 2026-10-12
CSS Bed is a website that gathers multiple classless CSS stylesheets developers can drop into a page's head tag as instant starting styles. Each theme requires no custom classes, works with plain HTML, and the project is open source on GitHub for bug reports or new theme submissions.
cssbed.com
· 2026-10-01
A Show HN project called PacBench evaluates how well different AI models and their supporting harnesses can recreate the classic game Pac-Man from a single prompt: 'Create a Pac-Man game in a single html page.' The benchmark measures how closely each model's generated code approximates a functioning Pac-Man game.
jonclegg.github.io
· 2026-09-28
A 25-year veteran web builder and current CEO of Builderall argues that having a website used to signal professionalism and drive traffic, but that advantage has vanished now that AI can generate a polished site in minutes. He cites Netcraft's March 2026 survey showing roughly 1.43 billion websites exist, yet only about 208 million show signs of active upkeep, meaning most are abandoned or dormant.
entrepreneur.com
· 2026-09-21
A web design tutorial addresses a common flexbox alignment issue: when a list item's icon sits beside wrapping text, using align-items: center leaves the icon vertically centered against the whole text block instead of matching the first line. The author demonstrates using align-items: start combined with a small transform: translateY offset on the icon to correct the visual gap caused by line-height spacing above the text glyphs.
ishadeed.com
· 2026-09-16
A retrospective catalogs obsolete HTML snippets that were never part of the official specification but emerged from browser wars, vendor extensions, and third-party integrations. Examples include the X-UA-Compatible meta tag used to force Internet Explorer into specific rendering modes, and the chrome=1 directive tied to Google's now-defunct Chrome Frame plugin that let IE 6-9 users render pages using Chrome's engine.
vale.rocks
· 2026-09-08
A developer found that CodePen's updated editor sends everything typed into its code fields to codepen.dev within one to two seconds, even without saving. Using a unique test marker in an HTML file, they confirmed CodePen triggered a build with save disabled and the marker still appeared verbatim in the generated preview page served from a codepen.dev subdomain.
news.ycombinator.com
· 2026-09-07
A software developer recounts how a fascination with building things from scratch drew them into programming, initially learning PHP, HTML and CSS to create back-end systems and websites. Over time, the writer says the appeal shifted from the act of coding itself toward creating products people actually use, pushing them toward startups and leadership roles rather than large companies or pure engineering work.
orchidfiles.com
· 2026-09-07
WebMCP is a new approach, currently running in Chrome under an experimental trial, that lets websites declare specific functions—like a book_table tool—that AI agents can call directly with structured parameters. This replaces the current method where agents must scrape raw HTML, guess which buttons or fields to interact with, and often break when a page's layout changes.
sreenathmenon.com
· 2026-08-26
Security researchers found that attackers can embed HTML invisible to human readers—such as white-on-white text or zero-size fonts—inside emails. When an AI-powered summarizer processes the message, it reads this hidden text as legitimate content and can produce a summary containing false or malicious instructions for the recipient.
darkreading.com
· 2026-08-25
GoKawiil