This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
Currently, scripts can call methods of HTMLMediaElement to pre-load and auto-play media even when the "preload" and "autoplay" attributes aren't applied or are blocked, allowing pages to consume data in the background without the user's knowledge. I propose that permission be required to call control methods (load, play, pause, etc) of HTMLMediaElement without user interaction.
HTML5.1 Bugzilla Bug Triage: Won't Fix While media manipulation could be abused by JavaScript in the way you describe it seems like it would be a conflict of interest for the site. In other words, why would the site that owns both the media element creation (and it's attributes) have dueling JavaScript that did something it didn't like? Naturally, as other libraries are often included in a page that could do bad things, there is a risk, but that is the risk taken whenever external code is loaded into the context of a page (and not done through an iframe). Furthermore, similar ideas are currently being discussed in the "interventions" spec, which aims to track what browsers are doing to mitigate these types of issues, and come to a mutual agreement on what may be standardized. I'd encourage you to participate there: https://github.com/WICG/interventions If this resolution is not satisfactory, please copy the relevant bug details/proposal into a new issue at the W3C HTML5 Issue tracker: https://github.com/w3c/html/issues/new where it will be re-triaged. Thanks!