IntSize PaintLayerScrollableArea::PixelSnappedContentsSize(
    const LayoutPoint& paint_offset) const {
  return PixelSnappedIntSize(overflow_rect_.Size(), paint_offset);
}

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.