Good point. I will see if this is exploitable. But please open an issue at https://github.com/kkapsner/CanvasBlocker/issues where we can discuss the implications and findings. Also communication is much easier there.