<p><strong>TLDR:</strong> WordPress is shipping React 19 in Gutenberg 23.3, targeting WordPress 7.1, with several removed APIs that plugin developers need to migrate away from now. A new browser fingerprinting technique called FROST exploits SSD I/O timing through the Origin Private File System API to identify which tabs and apps a visitor has open. Firefox 150 is rolling out a Smart Window mode with a built-in AI assistant that can read your tabs and history. A developer also published a detailed breakdown of a malware attack hidden inside SVG files in a fake job assessment repo.</p>
<hr>
<h2>React 19 upgrade in WordPress</h2>
<p>WordPress is moving from React 18 to React 19, landing first in Gutenberg plugin 23.3 and targeting WordPress 7.1. The removed APIs are the ones you’d expect: <code>ReactDOM.render</code>, <code>hydrate</code>, <code>unmountComponentAtNode</code>, and <code>findDOMNode</code> are all gone. <code>forwardRef</code> is deprecated in favor of passing <code>ref</code> as a regular prop, and <code>defaultProps</code> on function components no longer works — use ES6 defaults instead. TypeScript users have extra surface area to check: <code>MutableRefObject</code> is deprecated, and <code>ReactElement</code> props changed from <code>any</code> to <code>unknown</code>, which will surface type errors you may have been quietly ignoring.</p>
<h2>FROST: SSD timing attack via OPFS</h2>
<p>Researchers published a technique that uses JavaScript and the Origin Private File System API to measure SSD I/O contention timing. The result: a malicious site can infer which other websites you have open in other tabs — across different browsers — and which desktop apps are running, all with no user interaction beyond loading the page. No permissions prompt, no clicks. It’s a good reminder that OPFS is a powerful API with a non-obvious attack surface, and one worth watching as browser vendors figure out how to respond.</p>
<h2>Malware hidden in SVG files via fake job assessment</h2>
<p>A developer received a fake job assessment over Discord pointing to a GitHub repo. The payload was split across base64-encoded HTML comments inside SVG image files, reconstructed and <code>eval()</code>'d at startup. It fingerprinted the machine, exfiltrated <code>.env</code> files, <code>.pem</code> keys, SSH keys, and browser credentials, downloaded Windows executables, and established persistence via a VBS file in the Startup folder. The full attack chain writeup is worth reading before you next clone an unfamiliar repo — the advice to audit before running anything is obvious in hindsight but easy to skip under interview pressure.</p>
<h2>Firefox Smart Window rolls out in beta</h2>
<p>Firefox 150 is testing a Smart Window mode for US and Canada users that adds a built-in AI assistant with access to your open tabs, browsing history, and current page. You can pick between Gemini 2.5 Flash Lite, Qwen3, or a 120B GPT model, or point it at a custom LLM endpoint. Chats are stored locally, and there’s a toggle to block AI enhancements entirely. It’s a more privacy-conscious take on browser AI than most, though giving any assistant access to your full browsing history is still a meaningful trust decision.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Hologram v0.9</strong> adds a realtime layer with typed identity channels and pub/sub fan-out in pure Elixir, plus patches for plug CVE-2026-8468 and decimal CVE-2026-32686.</li>
<li><strong>CSS anchor positioning</strong> — the HTML <code>anchor</code> attribute was dropped from standardization; a workaround using <code>attr()</code> with data attributes and <code>&lt;custom-ident&gt;</code> types can wire up multiple anchor associations from a single CSS rule.</li>
<li><strong>Framer editor pricing</strong> dropped to $20/month across all plans, down from $40 on Pro and Scale.</li>
<li><strong>Solon AI</strong> is an open-source code review tool built around JSON playbooks for Next.js, WCAG 2.2, OWASP Top 10, and AI-generated code patterns — runs diffs through Claude Haiku and posts PR comments.</li>
<li><strong>VS Code Agents window</strong> is a new dashboard for managing multiple AI coding agent sessions across local, cloud, and remote environments, with Git worktree support for isolated work.</li>
<li><strong>Aube</strong> is a new JavaScript package manager from the creator of Mise with a 24-hour cooldown on newly published packages as a security measure.</li>
<li><strong>Scroll-driven animations</strong> — pure CSS fade-in/out using <code>animation-timeline: view()</code> with <code>animation-range-start</code> and <code>animation-range-end</code>, no JavaScript needed.</li>
<li><strong>CSS <code>content</code> property</strong> supports alternative text for screen readers via a <code>/</code> separator — useful accessibility detail from Thoughtbot’s dev roundup.</li>
<li><strong>Android 17</strong> makes adaptive resizability mandatory for apps targeting API level 37, with new Jetpack Compose grid, flexbox, and media query APIs for the full device range.</li>
<li><strong>WarpDrive</strong> is a lightweight, framework-agnostic data library from the Ember team with TypeScript support, SSR readiness, and reactive bindings across any framework.</li>
<li><strong>Expo Agent</strong> research project added push notifications, media upload, and faster deployments this week, building on last week’s Convex database and cross-platform auth additions.</li>
<li><strong>Brian Chesky (Airbnb)</strong> argued that the future of AI interfaces isn’t text-forward chatbots but visually rich agentic UIs — the iMessage-for-everything analogy is a decent framing for why generic chat interfaces fall short for complex domains.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A developer-focused roundup covering four main stories: WordPress is upgrading to React 19 in Gutenberg 23.3 with several removed APIs requiring plugin developer migration; a new browser fingerprinting attack called FROST exploits SSD I/O timing via the Origin Private File System API to identify open tabs and apps without user interaction; a detailed malware attack analysis reveals a payload hidden in SVG files from a fake job assessment repo that exfiltrates credentials and establishes persistence; and Firefox 150 is testing a Smart Window mode with a built-in AI assistant accessing tabs and history. Notable items include Hologram v0.9, CSS anchor positioning workarounds, VS Code Agents window, a new JavaScript package manager with a 24-hour publish cooldown, and Android 17 mandatory adaptive resizability.

React 19 lands in WordPress, FROST attack fingerprints users via SSD timing