Text in HTML attributes
Prose sitting in attributes that extractors and screen readers read and that a page never displays as body text.
How the text is hidden
The parser harvests a fixed set of slots from every element it walks: alt, title and aria-label everywhere; content on a <meta> whose name is one of the prose names (description, keywords, the Open Graph and Twitter title and description pairs, abstract, summary); value and placeholder on an <input> or <textarea>; and every data-* attribute. Each value becomes its own run with the reason hidden-attr, collected into a block whose role is altText.
Why a model still reads it
Attribute values are part of the DOM and part of the markup. A description reaches a model through a link unfurl or a metadata path without ever being on the page, a hidden input's value never renders anywhere, and data-* is what frameworks read — so the text arrives at the model on paths that have nothing to do with what a reader sees.
What we do about it
The rule matches a run in an altText block whose reason is hidden-attr, and reports informational with action flag. Nothing is stripped; what changes is that the text is now inside the analysis, so the codepoint rules run over it and R-5a escalates an instruction hidden in a data- attribute rather than never seeing it. Reading value and placeholder wherever they appear, rather than only on type="hidden", closed a one-character bypass found by the render oracle.
How often it fires
96.7% of Common Crawl — 399 real web pages as published, skewed to low-quality domains, measured 2026-08-23.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A crawl of 1.2 billion URLs across 24.8 million hosts found 15,300 validated injections on 11,700 pages, about 70% of them sitting in parts of the HTML a browser never renders — headers, comments and metadata.
Twenty-two distinct payload techniques found on real malicious sites — zero font size, elements pushed 9,999 pixels off screen, display:none, attribute cloaking and prompts tucked inside SVG — aimed at everything from ad-review evasion to forced transactions. The SVG case reached us as `clean` until engine 0.263.0.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API