Add scroll bubbling monkeypatches

spec.bs

@@ -230,6 +230,10 @@ spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions
   type: dfn
     for: permissions policy
       text: inherited policy; url: inherited-policy
+spec: css2; urlPrefix: https://www.w3.org/TR/CSS21/visuren.html
+  type: dfn
+    for: css2
+      text: viewport; url: viewport
 </pre>
 
 <style>
@@ -2444,6 +2448,31 @@ algorithms to achieve the outcomes described in the above explanatory content.
   /fenced-frame/permission-notification.https.html
 </wpt>
 
+<h3 id=cssom-monkeypatch>CSSOM View</h3>
+
+The [[!CSSOM-VIEW]] specification defines the {{Element/scrollIntoView()}} method that calls the
+[=scroll a target into view=] algorithm. This will not only scroll the {{Element}} or
+[=css2/viewport=] to make the target visible, but will also scroll [=tree/ancestor=]s if necessary
+to make the target visible, essentially causing the scroll to "bubble up". This means that
+{{Element/scrollIntoView()}} performed in a [=child navigable=] or [=fenced navigable container/
+fenced navigable=] can be observed by its embedder, allowing for collusion across a fenced frame
+boundary. This section patches the [=scroll a target into view=] algorithm to prevent that collusion
+at the expense of some utility.
+
+<div algorithm=scroll-target-into-view>
+  Modify the [=scroll a target into view=] algorithm to add a step at the end of the algorithm that
+  reads:
+
+  14. If <var ignore>scrolling box</var>'s associated {{Element}}'s associated {{Document}}'s [=node
+     navigable=]'s [=navigable/traversable navigable=] is a [=fenced navigable container/fenced
+     navigable=], or if <var ignore>scrolling box</var>'s associated [=css2/viewport=]'s associated
+     {{Document}}'s [=node navigable=]'s [=navigable/traversable navigable=] is a [=fenced navigable
+     container/fenced navigable=], then let this be the last instance of this algorithm that stops
+     any further recursive instances that would otherwise follow.
+
+  Note: This allows scrolling to "bubble up" to a fenced frame boundary, but not cross it.
+</div>
+
 <h2 id=security-and-privacy>Security & Privacy Considerations</h2>
 
 This material is being upstreamed from our explainer into this specification, and in the meantime