MCP server IntersectionObserver security — visibility timing side channels, element presence oracle, and cross-origin iframe leakage in MCP UIs

The visibility oracle attack in MCP UIs

Consider an MCP UI that renders each tool result in a separate container element with a data-tool-id attribute. A compromised MCP skill injects a script that creates an IntersectionObserver targeting all elements matching [data-tool-id]. When any tool result container enters the viewport, the observer callback fires with:

• entry.target — the element itself (readable from same-origin script)
• entry.boundingClientRect — element dimensions including height (reveals content length)
• entry.intersectionRatio — fraction of element visible
• entry.time — high-resolution timestamp of when visibility changed
• entry.isIntersecting — boolean: did the element enter the viewport?

From the callback the attacker can infer: which tool result is now being viewed by the user (presence oracle), the approximate length of the tool output (element height correlates with content length for text-heavy results), and how long the user spent viewing each result (by correlating isIntersecting: true and isIntersecting: false timestamps). The callback fires with no user gesture required and no permission prompt — IntersectionObserver is a standard Web API available to all scripts with DOM access.

Content-length inference via bounding rect

For text-based MCP tool output, element height correlates with content length. A result containing a 10-line API response renders taller than a one-line "success" confirmation. The boundingClientRect.height from the IntersectionObserver callback does not reveal the text, but it narrows the space of possible outputs. In combination with knowledge of the tool's output schema (available from the MCP server manifest), height correlation can identify specific outputs from a finite set of expected responses.

// Attacker's IntersectionObserver in injected script
const observer = new IntersectionObserver((entries) => {
  for (const entry of entries) {
    if (entry.isIntersecting) {
      // Height reveals approximate content length
      const approxLength = Math.round(entry.boundingClientRect.height / 20); // chars per line estimate
      exfiltrate({
        toolId: entry.target.dataset.toolId,
        height: entry.boundingClientRect.height,
        time: entry.time,
        approxContentLines: approxLength
      });
    }
  }
}, { threshold: 0.1 }); // fires when 10% visible

document.querySelectorAll('[data-tool-id]').forEach(el => observer.observe(el));

Cross-origin iframe content fingerprinting

IntersectionObserver can observe elements inside the same-origin document. For cross-origin iframes embedded in an MCP UI (e.g., a sandboxed tool result preview), IntersectionObserver cannot read the iframe's DOM — but it can observe the iframe element itself. The intersection callback reports the iframe's boundingClientRect, which reflects the iframe's rendered dimensions. If the cross-origin content in the iframe causes the iframe's height to change (e.g., via postMessage height adjustment from the iframe to the parent), those dimension changes are observable via IntersectionObserver on the parent frame.

This is a weaker vector than direct DOM access, but it leaks whether specific content was loaded in the iframe (by correlating height changes with known content fingerprints) and whether the user scrolled to view the iframe (via isIntersecting transitions).

Defense: limit IntersectionObserver attack surface in MCP UIs

The most effective defense is strict Content Security Policy that prevents any script from tool output from executing in the MCP UI context. IntersectionObserver is a DOM API — it requires script execution. If injected scripts cannot execute, the observer cannot be created.

// Strict CSP preventing tool-output script injection
Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'nonce-{RANDOM_NONCE}';
  style-src 'self' 'unsafe-inline';
  frame-src 'none';
  object-src 'none'

SkillAudit findings

See also: MCP server MutationObserver security (DOM exfiltration of tool output) · MCP server PerformanceObserver security (timing side channels)