v135 · svg

SVG Security Audit

Paste SVG markup containing <a> elements. Chrome 135's new SVGAElement.rel and SVGAElement.relList let you audit inline SVG links the same way you audit HTML anchors. This tool finds external links missing noopener/noreferrer and shows the fix.

checking SVGAElement.rel… checking SVGAElement.relList…
SVG <a target="_blank"> links without rel="noopener" expose window.opener to the target page, enabling tabnapping attacks. Before Chrome 135, SVGAElement lacked rel/relList, making it impossible to read or set these tokens via the DOM. Now you can audit and fix SVG links programmatically.

SVG markup to audit

How SVGAElement.relList works (Chrome 135)

// Chrome 135: SVGAElement now has .rel and .relList // just like HTMLAnchorElement const svgDoc = new DOMParser().parseFromString(svgMarkup, 'image/svg+xml'); const links = svgDoc.querySelectorAll('a'); links.forEach(a => { const href = a.getAttribute('href') || a.getAttribute('xlink:href') || ''; const target = a.getAttribute('target') || ''; const isExternal = href.startsWith('http'); const isBlankTarget = target === '_blank'; // Chrome 135: read rel tokens via relList (DOMTokenList) const hasNoopener = a.relList.contains('noopener'); const hasNoreferrer = a.relList.contains('noreferrer'); if (isExternal && isBlankTarget && !hasNoopener) { // Fix: add the missing tokens a.relList.add('noopener', 'noreferrer'); console.warn('Fixed tabnapping risk:', href); } });