v150 · Security · Filters
Origin Trust Ladder
The Chrome 150 SVG filter restriction creates a trust hierarchy: same-origin content can be filtered freely, while cross-origin content is protected. This trust ladder ranks every origin type — same-origin, cross-origin, sandboxed, data:, srcdoc, null — and shows which filter types are allowed, which are blocked, and why.
Filter type to examine
Origin trust ladder with expandable details
Origin type
Pre-150
Chrome 150+ (SVG)
Same-origin iframe / element
allowed
Cross-origin iframe (no sandbox)
allowed
Cross-origin +
sandbox=""blocked
data: URI iframeallowed
srcdoc iframe (same origin)allowed
Plugin embed (cross-origin)
allowed
Hover a row to see the reason for each ruling. The ladder shows the security principle: SVG filters with pixel-reading primitives (feDisplacementMap, feComposite) create information leakage across origin boundaries.
see also
- Clickjacking Replay — SVG filter attack demo
- Filter Comparison — SVG vs CSS filters
- Sandbox Filter Test — sandbox attribute matrix
- Policy Tester — live policy probe
- ChromeStatus entry