CSSOM and CORS in Chrome 64

Every once in a while a programmer runs into a bug worth sharing.

Our team had one of those today. Students were unable to use Design Mode in App Lab, but the issue only happened on Chrome, and only if the user had installed a browser extension that injects an external stylesheet into the page.

The problem was caused by a bad interaction between an unadvertised security fix in Chrome 64 and some old feature-detection code in our site meant to work around an issue with Internet Explorer 9. We had at least six members of our team investigating at one point.

Live and learn. We released a fix today in v2018-03-07.2. I’ve posted a more technical writeup on StackOverflow where it may be helpful to others in the future.