Chrome · Paint
CVE-2026-13922
Logic Error in Paint
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
third_party/blink/renderer/core/paint/filter_effect_builder.ccthird_party/blink/renderer/core/paint/filter_effect_builder.hthird_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.htmlthird_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html
Patch
From e422c5f1313e176353eac0b51144825b99a2ea85 Mon Sep 17 00:00:00 2001 From: Noam Rosenthal <[email protected]> Date: Mon, 18 May 2026 12:47:13 -0700 Subject: [PATCH] Taint reference filters when following currentcolor in drop-shadow Bug: 511748106 Change-Id: I54c000531ac0377dc3fbc5cd5e49e7314be8eee7 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7843200 Commit-Queue: Noam Rosenthal <[email protected]> Reviewed-by: Fredrik Söderquist <[email protected]> Cr-Commit-Position: refs/heads/main@{#1632347} --- diff --git a/third_party/blink/renderer/core/paint/filter_effect_builder.cc b/third_party/blink/renderer/core/paint/filter_effect_builder.cc index 17e7b66..96e8b03 100644 --- a/third_party/blink/renderer/core/paint/filter_effect_builder.cc +++ b/third_party/blink/renderer/core/paint/filter_effect_builder.cc @@ -379,8 +379,8 @@ switch (op->GetType()) { case FilterOperation::OperationType::kReference: { auto& reference_operation = To<ReferenceFilterOperation>(*op); - Filter* reference_filter = - BuildReferenceFilter(reference_operation, nullptr); + Filter* reference_filter = BuildReferenceFilter( + reference_operation, nullptr, nullptr, filters.OriginTainted()); if (reference_filter && reference_filter->LastEffect()) { // Set the interpolation space for the source of the (sub)filter to // match that of the previous primitive (or input). @@ -478,6 +478,9 @@ filters.AppendDropShadowFilter( floored_offset, radius, shadow.GetColor().Resolve(current_color_, color_scheme_)); + if (shadow.GetColor().IsCurrentColor()) { + filters.SetOriginTainted(); + } break; } case FilterOperation::OperationType::kBoxReflect: { @@ -511,7 +514,8 @@ Filter* FilterEffectBuilder::BuildReferenceFilter( const ReferenceFilterOperation& reference_operation, FilterEffect* previous_effect, - SVGFilterGraphNodeMap* node_map) const { + SVGFilterGraphNodeMap* node_map, + bool input_tainted) const { SVGResource* resource = reference_operation.Resource(); auto* filter_element = DynamicTo<SVGFilterElement>(resource ? resource->Target() : nullptr); @@ -545,6 +549,10 @@ return result; } + if (input_tainted || (previous_effect && previous_effect->OriginTainted())) { + result->GetSourceGraphic()->SetOriginTainted(); + } + if (!previous_effect) previous_effect = result->GetSourceGraphic(); SVGFilterBuilder builder(previous_effect, node_map, fill_flags_, diff --git a/third_party/blink/renderer/core/paint/filter_effect_builder.h b/third_party/blink/renderer/core/paint/filter_effect_builder.h index 15bd906..d09119bf 100644 --- a/third_party/blink/renderer/core/paint/filter_effect_builder.h +++ b/third_party/blink/renderer/core/paint/filter_effect_builder.h @@ -56,7 +56,8 @@ Filter* BuildReferenceFilter(const ReferenceFilterOperation&, FilterEffect* previous_effect, - SVGFilterGraphNodeMap* = nullptr) const; + SVGFilterGraphNodeMap* = nullptr, + bool input_tainted = false) const; FilterEffect* BuildFilterEffect(const FilterOperations&, bool input_tainted = false) const; diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html new file mode 100644 index 0000000..c7ccf04 --- /dev/null +++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<title>Reference for CSS filter: drop-shadow with currentColor on a link</title> +<style> + a { + display: block; + width: 100px; + height: 100px; + background-color: green; + filter: drop-shadow(0px 0px 0px currentColor); + } + a:link { + color: green; + } + a:visited { + color: red; + } +</style> +<a href="https://example.com/"></a> diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html new file mode 100644 index 0000000..e3d59004 --- /dev/null +++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<title>CSS filter: drop-shadow with currentColor on a link propagates tainting to subsequent SVG filters</title> +<link rel="help" href="https://drafts.csswg.org/filter-effects-1/#tainted-filter-primitives"> +<link rel="match" href="reference/tainting-css-dropshadow-currentcolor-ref.html"> +<meta name="fuzzy" content="maxDifference=0-32; totalPixels=32"> +<style> + a { + display: block; + width: 100px; + height: 100px; + background-color: green; + filter: drop-shadow(0px 0px 0px currentColor) url(#dispmap); + } + a:link { + color: green; + } + a:visited { + color: red; + } +</style> +<svg xmlns="http://www.w3.org/2000/svg" style="display: none"> + <filter id="dispmap" color-interpolation-filters="sRGB"> + <feDisplacementMap in="SourceGraphic" in2="SourceGraphic" + xChannelSelector="R" scale="200"/> + </filter> +</svg> +<a href="https://example.com/"></a>
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html
new file mode 100644
index 0000000..c7ccf04
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title>Reference for CSS filter: drop-shadow with currentColor on a link</title>
+<style>
+ a {
+ display: block;
+ width: 100px;
+ height: 100px;
+ background-color: green;
+ filter: drop-shadow(0px 0px 0px currentColor);
+ }
+ a:link {
+ color: green;
+ }
+ a:visited {
+ color: red;
+ }
+</style>
+<a href="https://example.com/"></a>
diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html
new file mode 100644
index 0000000..e3d59004
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>CSS filter: drop-shadow with currentColor on a link propagates tainting to subsequent SVG filters</title>
+<link rel="help" href="https://drafts.csswg.org/filter-effects-1/#tainted-filter-primitives">
+<link rel="match" href="reference/tainting-css-dropshadow-currentcolor-ref.html">
+<meta name="fuzzy" content="maxDifference=0-32; totalPixels=32">
+<style>
+ a {
+ display: block;
+ width: 100px;
+ height: 100px;
+ background-color: green;
+ filter: drop-shadow(0px 0px 0px currentColor) url(#dispmap);
+ }
+ a:link {
+ color: green;
+ }
+ a:visited {
+ color: red;
+ }
+</style>
+<svg xmlns="http://www.w3.org/2000/svg" style="display: none">
+ <filter id="dispmap" color-interpolation-filters="sRGB">
+ <feDisplacementMap in="SourceGraphic" in2="SourceGraphic"
+ xChannelSelector="R" scale="200"/>
+ </filter>
+</svg>
+<a href="https://example.com/"></a>
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page