)]}'
{"id": 5117170452398080, "name": "Disable SVG filters on plugins and iFrames", "summary": "Chrome 150 will prevent Scalable Vector Graphics (SVG) filters from being applied to embedded plugins (for example, PDFs) and cross-origin or restricted iFrames (for example, sandboxed ones). When a plugin or iFrame would be painted with an SVG filter effect, the effect tree is traversed to find the highest ancestor without SVG filters, and that effect is then applied instead.", "markdown_fields": ["summary"], "blink_components": ["Blink>SVG"], "star_count": 36, "search_tags": [], "created": {"by": "arichiv@chromium.org", "when": "2026-04-28 13:05:11.648475"}, "updated": {"by": "siobhankeating@google.com", "when": "2026-06-17 09:57:23.861240"}, "category": "Security", "category_int": 3, "feature_notes": null, "web_feature": "svg-filters", "is_official_web_feature": true, "webdx_usecounter_enum": null, "enterprise_feature_categories": [], "enterprise_product_category": 0, "is_releasenotes_content_reviewed": true, "is_releasenotes_publish_ready": true, "stages": [{"id": 5118875755741184, "created": "2026-04-28 13:05:12.502053", "feature_id": 5117170452398080, "stage_type": 110, "display_name": null, "intent_stage": 7, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 6273660928262144, "created": "2026-04-28 13:05:12.598560", "feature_id": 5117170452398080, "stage_type": 120, "display_name": null, "intent_stage": 1, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 6301202003394560, "created": "2026-04-28 13:05:12.727943", "feature_id": 5117170452398080, "stage_type": 130, "display_name": null, "intent_stage": 2, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5076636228780032, "created": "2026-04-28 13:05:12.789648", "feature_id": 5117170452398080, "stage_type": 140, "display_name": null, "intent_stage": 4, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5193358139064320, "created": "2026-04-28 13:05:12.860643", "feature_id": 5117170452398080, "stage_type": 150, "display_name": null, "intent_stage": 3, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5184709014454272, "created": "2026-04-28 13:05:12.985102", "feature_id": 5117170452398080, "stage_type": 160, "display_name": null, "intent_stage": 5, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": "https://groups.google.com/a/chromium.org/d/msgid/blink-dev/69f0bef1.050a0220.3ab19.0360.GAE%40google.com", "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": 150, "android_first": 150, "ios_first": null, "webview_first": 150, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}], "accurate_as_of": "2026-06-01 10:10:18.086528", "creator_email": "arichiv@chromium.org", "updater_email": "siobhankeating@google.com", "owner_emails": ["arichiv@chromium.org"], "editor_emails": ["pdr@chromium.org", "miketaylr@chromium.org"], "cc_emails": [], "spec_mentor_emails": [], "unlisted": false, "deleted": false, "editors": ["pdr@chromium.org", "miketaylr@chromium.org"], "cc_recipients": [], "spec_mentors": [], "creator": "arichiv@chromium.org", "feature_type": "New or changed feature", "feature_type_int": 0, "intent_stage": "None", "intent_stage_int": 0, "active_stage_id": 5184709014454272, "bug_url": "https://crbug.com/476646486", "launch_bug_url": "https://launch.corp.google.com/launch/4470371", "new_crbug_url": "https://bugs.chromium.org/p/chromium/issues/entry?components=Blink>SVG&blocking=476646486&cc=arichiv@chromium.org", "screenshot_links": [], "first_enterprise_notification_milestone": 149, "enterprise_impact": 2, "breaking_change": false, "confidential": false, "shipping_year": 2026, "flag_name": null, "finch_name": "kPreventSvgFilterPaint", "non_finch_justification": null, "ongoing_constraints": null, "rollout_plan": 0, "rollout_plan_displayname": "Will ship enabled for all users", "motivation": "SVG clickjacking (https://lyra.horse/blog/2025/12/svg-clickjacking/) is a new spin on clickjacking which uses dynamic SVG filters to disguise content and manipulate users into taking actions they might not otherwise. Additionally, we would like to further restrict timing attacks (https://media.blackhat.com/us-13/US-13-Stone-Pixel-Perfect-Timing-Attacks-with-HTML5-WP.pdf) involving SVG filters.", "devtrial_instructions": null, "activation_risks": null, "measurement": "Existing counters track usage:\nhttps://chromestatus.com/metrics/feature/timeline/popularity/5828\nhttps://chromestatus.com/metrics/feature/timeline/popularity/5829", "availability_expectation": null, "adoption_expectation": null, "adoption_plan": null, "initial_public_proposal_url": null, "explainer_links": [], "requires_embedder_support": false, "spec_link": "https://github.com/w3c/csswg-drafts/pull/13846", "api_spec": false, "automation_spec": false, "interop_compat_risks": null, "all_platforms": true, "all_platforms_descr": "This impacts all platforms using blink.", "non_oss_deps": null, "anticipated_spec_changes": "", "security_risks": null, "ergonomics_risks": null, "wpt": true, "wpt_descr": "svg/styling/svg-filter-render-*.tentative.https.html provides cross-browser reference tests.\n", "webview_risks": null, "devrel_emails": ["devrel-chromestatus-all@google.com"], "debuggability": null, "doc_links": [], "sample_links": [], "prefixed": null, "tags": [], "tag_review": "Not applicable, this isn\u2019t adding a new feature but disabling one we perhaps should not have supported.", "tag_review_status": "Not applicable", "tag_review_status_int": 4, "security_review_status": "Issues open", "security_review_status_int": 2, "privacy_review_status": "Issues open", "privacy_review_status_int": 2, "security_continuity_id": null, "security_launch_issue_id": null, "updated_display": null, "resources": {"samples": [], "docs": []}, "comments": null, "ff_views": 10, "safari_views": 1, "web_dev_views": 4, "browsers": {"chrome": {"bug": "https://crbug.com/476646486", "blink_components": ["Blink>SVG"], "devrel": ["devrel-chromestatus-all@google.com"], "owners": ["arichiv@chromium.org"], "origintrial": false, "prefixed": null, "flag": false, "status": {"text": "Proposed", "val": 2, "milestone_str": "Proposed"}, "announced": true, "desktop": 150, "android": 150, "webview": 150, "ios": null}, "ff": {"view": {"url": "https://github.com/mozilla/standards-positions/issues/1395", "notes": "Currently allows SVG filters on all iframes/plugins.", "text": "Under consideration", "val": 10}}, "safari": {"view": {"url": "https://github.com/WebKit/standards-positions/issues/654", "notes": "Currently disables SVG filters on plugins and cross-origin iframes, but allows them on same-origin iframes.", "text": "Shipped/Shipping", "val": 1}}, "webdev": {"view": {"text": "No signals", "val": 4, "url": null, "notes": null}}, "other": {"view": {"text": null, "val": null, "url": null, "notes": null}}}, "standards": {"spec": "https://github.com/w3c/csswg-drafts/pull/13846", "maturity": {"text": null, "short_text": "Unknown status", "val": 0}}, "is_released": false, "is_enterprise_feature": false, "experiment_timeline": null, "ai_test_eval_report": null, "ai_test_eval_run_status": null, "ai_test_eval_status_timestamp": null}