Visitar URL original
[Bug]: fluent-link and fluent-anchor-button don't show the destination URL on hover (regression from inert proxy anchor) · Issue #37063 · microsoft/fluentui · GitHub
Skip to content

[Bug]: fluent-link and fluent-anchor-button don't show the destination URL on hover (regression from inert proxy anchor) #37063

Open

Description

@Hotell

Component

Link (also affects fluent-anchor-button)

Package version

3.0.0-rc.16 and later (verified on 3.0.0-rc.16 and the live Storybook at 3.1.x)

@microsoft/fast-element version

^3.0.0

Environment

Chromium, Firefox and WebKit (Playwright); Chrome / Edge / Firefox / Safari desktop

Current Behavior

fluent-link and fluent-anchor-button don't behave like native links for pointer users:

  • Hovering doesn't show the destination URL in the browser status bar, so users can't see where the link goes before they activate it.
  • Middle-click doesn't open the link in a new tab.
  • Right-click shows the generic page context menu instead of the link menu ("Open link in new tab", "Copy link address", …).

Hit-testing at the center of the component returns the host element instead of an <a href>:

Version document.elementFromPoint at center Middle-click opens tab
3.0.0-rc.15 <a href> (proxy anchor) ✅ ✅
3.0.0-rc.16 / current FLUENT-LINK / FLUENT-ANCHOR-BUTTON ❌ ❌

Root cause

BaseAnchor (src/anchor-button/anchor-button.base.ts, shared by Link and AnchorButton) puts a proxy <a> over the component (position: absolute; inset: 0). The browser uses this anchor for native link behavior. #36085 (fix for #36066, duplicate click events) changed the proxy from aria-hidden="true" + tabindex="-1" to inert = true. Inert elements are excluded from hit-testing, so the pointer never reaches the anchor and the browser doesn't see a link.

React v9 Link renders a native <a> and isn't affected.

Expected Behavior

Pointer interaction behaves like a native <a href>: the destination URL shows on hover, middle-click and Ctrl/Cmd-click open a new tab, and the link context menu is available. The double click event fixed in #36066 must not come back.

Reproduction

https://storybooks.fluentui.dev/web-components/?path=/docs/components-link--docs

Steps to reproduce

  1. Open https://storybooks.fluentui.dev/web-components/?path=/docs/components-link--docs (or components-button-anchor--docs).
  2. Hover any link: the browser status bar doesn't show the URL.
  3. Middle-click or right-click the link: no new tab / no link context menu.
  4. Compare with https://storybooks.fluentui.dev/react/?path=/docs/components-link--docs, where all of the above work.

Are you reporting an Accessibility issue?

no

Suggested severity

High - No workaround

Products/sites affected

No response

Are you willing to submit a PR to fix?

yes

Validations

  • Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
  • The provided reproduction is a minimal reproducible example of the bug.

Activity

  1. MarvinKlein1508 commented on Nov 4, 2026

    @MarvinKlein1508

    This also allows developers to hide malicious links within these components, preventing users from verifying the destination URL before clicking. This is particularly concerning because the components use Microsoft's official design language, making them appear trustworthy and potentially misleading users into believing that the links are safe.

    Furthermore, this behavior differs from that of the equivalent React components.

    This could be exploited by attackers to redirect unsuspecting users to phishing websites. This is why I previously submitted the following security vulnerability report:

    https://msrc.microsoft.com/report/vulnerability/VULN-256363

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions