SA-2026-012: The Ask pane: a captured title could run script and reach the reader's vault key

What it is

The Ask pane escaped the model's answer, inserted citation links whose title attribute held the cited item's title, then ran a URL linkifier over the whole string, attributes included. A title holding " https://..." got a link inserted inside the title attribute, and its quote closed the attribute.

What an attacker could do

Reproduced in Chromium: a hover on the citation ran script on the site's origin, where the /now/ vault key (and through it the reader's OpenRouter key) and enrolled signing keys live.

How: A captured tweet or page title carries " https://t.co/a/onmouseover=...//"; the build copies it into now/now.json; a reader asks a question and the model cites that item.

Root cause

HTML was assembled with regexes in several passes, each pass unaware of the context the previous one had created.

What contributed

• Third-party titles reach the browser as data (now.json) and are trusted as ours.
• The site had no Content-Security-Policy, so nothing stood behind the escaping.
• The secrets of /now/ share one origin with every page.

What was not in place

A renderer that builds DOM nodes, and a CSP.

The fix

The answer is built as DOM nodes; titles only ever become text nodes or attributes set with setAttribute.

What prevents it now

The CSP (SA-2026-018) blocks inline handlers and injected scripts; the review checklist now asks of every new innerHTML which context each piece of data lands in.