Lyra Rebane discovered a novel clickjacking technique using SVG filters to create complex, multi-step attacks against cross-origin iframes.
By leveraging filter primitives like feDisplacementMap, feComposite, and feColorMatrix, attackers can read pixel data and implement logic gates to display responsive overlays, all without JavaScript.
This earned a $3,133.70 Google VRP bounty and represents the first documented method combining SVG filter logic with interactive clickjacking.
Pixel reading through SVG filters has a history: in 2013, Paul Stone of Context Information Security showed that the rendering time of SVG filters leaks pixel values from cross-origin iframes, a JavaScript timing side channel that modern browsers have since mitigated.
