MCP server CSS overflow-clip-margin-inline-end security: acceptance clause end-clipping, LTR line-end removal, RTL start-side attacks, and asymmetric inline-end margin attacks

Published 2026-09-25 — SkillAudit Research

The CSS overflow-clip-margin-inline-end property is the counterpart of overflow-clip-margin-inline-start. It controls the extension of the clip region beyond the element's padding box on the inline-end edge only — in left-to-right documents, the right edge; in right-to-left documents, the left edge. The two longhands together with -block-start and -block-end form the full set of overflow-clip-margin per-edge controls.

The inline-end clip attack is complementary to the inline-start attack but targets a different and often more legally critical portion of consent text. In standard LTR English legal consent language, sentence-ending words carry the highest legal weight: irrevocably, waive, binding arbitration, non-refundable, permanent. These modifier and qualifier terms appear at the end of sentences — the inline-end side. Setting overflow-clip-margin-inline-end: 0 while granting generous margins to other edges clips precisely these terms from the visible render while leaving the grammatical structure of the sentence intact.

Attack findings

.consent-dialog {
  overflow: clip;
  width: 480px;  /* engineered to break lines before legal qualifiers */
  overflow-clip-margin-block-start:  20px;
  overflow-clip-margin-block-end:    20px;
  overflow-clip-margin-inline-start: 20px;
  overflow-clip-margin-inline-end:   0;    /* right edge: hard clip */
}
/* Line-break engineering:
   "You grant access to your email account irrevocably and permanently,"
   with font-size:14px in 480px = "You grant access to your email account"
   on line 1 (visible) + "irrevocably and permanently," on line 2's start.
   But with overflow-clip-margin-inline-end:0, any text that extends to
   the right of the padding box is clipped.
   If text-align:right or inline-end pushing is applied, line-end words
   are the most likely to be pushed outside the zero-margin boundary. */

.consent-dialog[dir="rtl"] {
  direction: rtl;
  overflow: clip;
  /* In RTL: inline-end is the LEFT edge */
  overflow-clip-margin-inline-end:   0;    /* clips LEFT edge — sentence endings in RTL */
  overflow-clip-margin-inline-start: 40px; /* inline-start is RIGHT in RTL — generous */
}
/* Arabic/Hebrew consent text: sentence-ending qualifiers on left side.
   These are clipped. Sentence beginnings (right side) remain visible.
   User reads truncated sentences missing the binding qualification. */

/* overflow:hidden + text-overflow:ellipsis = visible truncation signal */
.safe { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }

/* overflow:clip bypasses text-overflow: no ellipsis, no truncation signal */
.consent-dialog {
  overflow: clip;
  overflow-clip-margin-inline-end: 0;
  /* text-overflow: ellipsis has no effect with overflow:clip */
}

Detection

function checkOverflowClipMarginInlineEnd(el) {
  const cs = getComputedStyle(el);
  if (cs.overflow !== 'clip' && cs.overflowX !== 'clip' && cs.overflowY !== 'clip') {
    return null;
  }

  const marginIE = parseFloat(cs.getPropertyValue('overflow-clip-margin-inline-end')   || '0');
  const marginIS = parseFloat(cs.getPropertyValue('overflow-clip-margin-inline-start') || '0');
  const marginBS = parseFloat(cs.getPropertyValue('overflow-clip-margin-block-start')  || '0');
  const marginBE = parseFloat(cs.getPropertyValue('overflow-clip-margin-block-end')    || '0');

  const findings = [];

  if (marginIE === 0 && (marginIS > 0 || marginBS > 0 || marginBE > 0)) {
    const direction   = cs.direction;
    const writingMode = cs.writingMode;
    let physicalEdge = 'right (LTR end)';
    if (direction === 'rtl') physicalEdge = 'left (RTL inline-end)';
    if (writingMode.includes('vertical')) physicalEdge = 'bottom (vertical writing mode inline-end)';

    findings.push({
      severity: 'high',
      issue: `overflow-clip-margin-inline-end:0 while other edges have margins — asymmetric ${physicalEdge} edge clip removes sentence endings`
    });
  }

  // Check for overflow:clip without text-overflow:ellipsis signal
  if (marginIE === 0 && cs.textOverflow !== 'ellipsis') {
    findings.push({
      severity: 'medium',
      issue: 'overflow:clip with inline-end:0 — no ellipsis indicator; truncation is invisible to users'
    });
  }

  return findings.length ? findings : null;
}

Remediation