UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/48.0.2564.82 Chrome/48.0.2564.82 Safari/537.36

Example URL:
data:text/html,<h1 contenteditable>XYZ<span contenteditable=false>xyz</span></h1>

Steps to reproduce the problem:
1. Open the data URI above
2. Click at the start, then press the right arrow key four times.
3. Note that the cursor appears between 'Z' and 'x' (as if it has not passed the ce=false span).

What is the expected behavior?
The cursor should appear after the 'xyz'.

What went wrong?
This is a just display bug; typing will insert text after 'xyz', and s=window.getSelection();[s.focusNode,s.focusOffset] shows that the cursor is actually at the end of the block (after the ce=false span).

It seems to relate to Chromium's left-normalization of cursor positions. There is no problem with the reflected case where the contenteditable=false island is at the paragraph start. (That is, if you open data:text/html,<h1 contenteditable><span contenteditable=false>abc</span>ABC</h1> , click at the end, then press the left arrow key four times, then the cursor is correctly rendered before the 'a').

Does it occur on multiple sites: Yes

Is it a problem with a plugin? No 

Did this work before? N/A 

Does this work in other browsers? Yes 

Chrome version: 48.0.2564.82  Channel: n/a
OS Version: 
Flash Version: 

See also https://bugs.chromium.org/p/chromium/issues/detail?id=605418 - the case when the contenteditable=false island is visually, but not logically, at the end of the paragraph.