Steps to reproduce:

1. Open this URL in Chrome:
   data:text/html,<div contentEditable="true" role="textbox" aria-multiline="true">Before<ul><li>a</li><li>b</li></ul>After</div>
2. Focus the text box and ensure you are in focus mode.
3. Press control+home.
4. Read through the content line by line using the down arrow key.

Expected behavior:

Before
list  bullet  a
bullet  b
out of list  After

Actual behavior:

Before
list  bullet  a
list  bullet  b
After

Note: Whether you hear "bullet" depends on your symbol level; I have mine set to "all".

System configuration:

NVDA version: next-14373,6bbe5915
NVDA Installed or portable: installed
Windows version: Windows 10 Version 1703 (OS Build 16251.0)
Name and version of other software in use when reproducing the issue: Chrome Version 62.0.3201.2 (Official Build) canary (64-bit)

Technical info:

This happens because a contentEditable list (the ul tag) does not get the read-only state. Lists and list boxes both get the same role (list), but they're normally differentiated by the read-only state; a <ul> has read-only, whereas a <select size="2"> doesn't. However, in this case, I can kinda understand why Chrome doesn't set read-only; after all, it does have the editable state.

I think we should probably just tweak TextInfo.getPresentationCategory to treat editable liss as being containers; i.e. allow for the editable state as well as the read-only state in the rule for PRESCAT_CONTAINER. Alternatively, we could file a bug against Chrome requesting this get fixed on their side.

P2 because this is quite annoying when dealing with rich text editors in Chrome, including the Gmail composer.