v149 · Security · CSP

CSP Policy Inspector

The Chrome 149 restriction blocks SVG filter effects on cross-origin iframes and plugin embeds. This inspector shows how different sandbox configurations and origin combinations interact with the new policy — and generates the correct CSP / sandbox attributes to declare intent.

Frame / embed policy matrix

Frame type & origin

SVG filter

CSS filter

Chrome 149+

Same-origin iframe

allowed

no change

Cross-origin iframe (no sandbox)

was allowed

allowed

SVG blocked

Cross-origin + sandbox=""

blocked

allowed

SVG blocked

Plugin embed (cross-origin)

was allowed

n/a

SVG blocked

data: URI iframe

was allowed

allowed

SVG blocked

Sandbox attribute builder

Select the sandbox permissions to grant — the resulting sandbox attribute is shown below (SVG filters are blocked regardless).

allow-scripts

allow-forms

allow-popups

allow-same-origin

allow-top-navigation

// toggle permissions above and click Generate

Key takeaway: The new restriction targets only filter attributes that reference SVG <filter> elements. The CSS filter property (blur, brightness, contrast, etc.) on iframes is unaffected. Use the matrix above to identify which frame configurations in your app need remediation.

<!-- SVG filter applied to a cross-origin iframe → BLOCKED in Chrome 149 -->
<svg>
  <filter id="blur"><feGaussianBlur stdDeviation="4"/></filter>
  <foreignObject>
    <iframe src="https://cross-origin.example" filter="url(#blur)"></iframe>
  </foreignObject>
</svg>

<!-- CSS filter on cross-origin iframe → still allowed -->
<iframe src="https://cross-origin.example"
        style="filter: blur(4px)"></iframe>

see also