Other nomination

SVG Filters - Clickjacking 2.0

rebane2001 · lyra's epic blog · 4 December 2025

SVG filters still apply to cross-origin iframes, and tiling, blending and compositing primitives can crop single pixels of the framed page and combine them into logic gates. An overlay can then read the framed application's state and react to it, making multi-step clickjacking with fake dialogs practical, and exfiltrating read pixels as a scannable code.

Record

Researcher

rebane2001

Published by

lyra's epic blog

Date

4 December 2025

In the archive

• Nominated for the 2025 Top 10 Web Hacking Techniques

Related sources

• Early SVG clickjacking prototype

Tags

• clickjacking
• ui-redress
• sop-bypass
• info-leak
• side-channel
• iframe
• css
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of rebane2001, first published at the original source. Preserved copies are kept so the citation survives its host.