v135 · svg
SVG Security Audit
Paste SVG markup containing <a> elements. Chrome 135's new SVGAElement.rel and SVGAElement.relList let you audit inline SVG links the same way you audit HTML anchors. This tool finds external links missing noopener/noreferrer and shows the fix.
checking SVGAElement.rel…
checking SVGAElement.relList…
SVG
<a target="_blank"> links without rel="noopener" expose window.opener to the target page, enabling tabnapping attacks. Before Chrome 135, SVGAElement lacked rel/relList, making it impossible to read or set these tokens via the DOM. Now you can audit and fix SVG links programmatically.
SVG markup to audit
How SVGAElement.relList works (Chrome 135)
// Chrome 135: SVGAElement now has .rel and .relList
// just like HTMLAnchorElement
const svgDoc = new DOMParser().parseFromString(svgMarkup, 'image/svg+xml');
const links = svgDoc.querySelectorAll('a');
links.forEach(a => {
const href = a.getAttribute('href') || a.getAttribute('xlink:href') || '';
const target = a.getAttribute('target') || '';
const isExternal = href.startsWith('http');
const isBlankTarget = target === '_blank';
// Chrome 135: read rel tokens via relList (DOMTokenList)
const hasNoopener = a.relList.contains('noopener');
const hasNoreferrer = a.relList.contains('noreferrer');
if (isExternal && isBlankTarget && !hasNoopener) {
// Fix: add the missing tokens
a.relList.add('noopener', 'noreferrer');
console.warn('Fixed tabnapping risk:', href);
}
});