In light of recent attacks, reviving this task.

First of all, the current state of things has changed over the past year. Some layer security patches have been applied as part of other security bugs.

Current state of Vector (using example code from T40848#425108):

{F3198387}

* Logo: Safe, but transparent
* Sidebar: Safe, but transparent
* Personal: Safe, but transparent
* Page tabs: Safe, but transparent
* Search: Safe, but transparent
* Sitenotice: Not safe
* Page name: Not safe

"Safe" refers to the visibility and click-ability of the above listed components' contents. Not their container overall. Meaning, an attacker is not able to change the link target of any of our user interface links and cannot overlap e.g. the logo. However, as you can see, the space in between the sidebar links and page tabs etc is still vulnerable because things can be layered underneath. This is why the z-index approach is only effective as an attack, not as a defence.

Overflow-hidden is still the best way forward. However as mentioned, this is non-trivial because of established use cases from the community surrounding "hacks" that place icons outside the page content area (e.g. Geo coordinates, Featured article status, Spoken Wikipedia, etc.). This use case has been recognised by MediaWiki in 2014 in the MediaWiki 1.25 release cycle ([mw:Help:Page status indicators](https://www.mediawiki.org/wiki/Help:Page_status_indicators)). I don't know how well this has been adopted by now. I'd say we give communities a heads up through mailing lists, ambassadors and tech news and then go ahead with it.

Proposed change A:
```lang=css
.mw-body {
    overflow: hidden;
}
```

Impact:
{F3198404}

This has no bad side sides (compared to status quo) and protects transparency from all currently safe areas. It still leaves page title and site notice unsafe, however. This proposal exists because of the side effects and complications with the following proposals. I'd recommend this as a transitional change to cover most of our problem space while we work on the rest.

Proposed change B:
```lang=css
.mw-body-content {
    overflow: hidden;
}
```
{F3198430}


This places all listed areas in safety (including the previously unsafe site notice and page title). Side effects:
* This would break any "top icons" and "indicators" that haven't migrated from absolute-position to using `<indicator>` yet. (This shrinks the overflow area from mw-body to mw-body-content, meaning content can't overlay icons and images next to the page title. An otherwise desirable change.)
* This breaks `<div id="contentSub">` anti-margin collapse. This element is unfortunately within mw-body-content in most skins. It is empty by default and enjoys CSS auto margin collapse and takes up no space. Setting overflow-hidden on its container (mw-body-content) means it is no longer able to collapse its margin with the page title. As such, creating a relatively large white gap between the page title and the start of the content.

Proposed change C:
```lang=css
#mw-content-text {
    position: relative;
    overflow: hidden;
}
```
{F3198450}

This places all listed areas in safety (including the previously unsafe site notice and page title). Side effects:
* Breaks any indicators that haven't migrated yet (same as B).
* This breaks content heading anti-margin collapse. Even if we move out `contentSub` to be child of mw-body directly before mw-body-content, the same effect will still affect margin collapse between the first heading of the content area (e.g. wikiPreview's "Preview" in the screenshot, or something like the heading atop the sandbox page). This creates an even bigger gap. Something that could be worked around by targeting the first mw-heading and cancelling its top margin manually. I'd like to avoid this as it significantly complicates future changes.