Chrome · Paint
CVE-2026-13922
Logic Error in Paint
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
third_party/blink/renderer/core/paint/filter_effect_builder.ccthird_party/blink/renderer/core/paint/filter_effect_builder.hthird_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.htmlthird_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html
Patch
From e422c5f1313e176353eac0b51144825b99a2ea85 Mon Sep 17 00:00:00 2001
From: Noam Rosenthal <nrosenthal@chromium.org>
Date: Mon, 18 May 2026 12:47:13 -0700
Subject: [PATCH] Taint reference filters when following currentcolor in drop-shadow
Bug: 511748106
Change-Id: I54c000531ac0377dc3fbc5cd5e49e7314be8eee7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7843200
Commit-Queue: Noam Rosenthal <nrosenthal@google.com>
Reviewed-by: Fredrik Söderquist <fs@opera.com>
Cr-Commit-Position: refs/heads/main@{#1632347}
---
diff --git a/third_party/blink/renderer/core/paint/filter_effect_builder.cc b/third_party/blink/renderer/core/paint/filter_effect_builder.cc
index 17e7b66..96e8b03 100644
--- a/third_party/blink/renderer/core/paint/filter_effect_builder.cc
+++ b/third_party/blink/renderer/core/paint/filter_effect_builder.cc
@@ -379,8 +379,8 @@
switch (op->GetType()) {
case FilterOperation::OperationType::kReference: {
auto& reference_operation = To<ReferenceFilterOperation>(*op);
- Filter* reference_filter =
- BuildReferenceFilter(reference_operation, nullptr);
+ Filter* reference_filter = BuildReferenceFilter(
+ reference_operation, nullptr, nullptr, filters.OriginTainted());
if (reference_filter && reference_filter->LastEffect()) {
// Set the interpolation space for the source of the (sub)filter to
// match that of the previous primitive (or input).
@@ -478,6 +478,9 @@
filters.AppendDropShadowFilter(
floored_offset, radius,
shadow.GetColor().Resolve(current_color_, color_scheme_));
+ if (shadow.GetColor().IsCurrentColor()) {
+ filters.SetOriginTainted();
+ }
break;
}
case FilterOperation::OperationType::kBoxReflect: {
@@ -511,7 +514,8 @@
Filter* FilterEffectBuilder::BuildReferenceFilter(
const ReferenceFilterOperation& reference_operation,
FilterEffect* previous_effect,
- SVGFilterGraphNodeMap* node_map) const {
+ SVGFilterGraphNodeMap* node_map,
+ bool input_tainted) const {
SVGResource* resource = reference_operation.Resource();
auto* filter_element =
DynamicTo<SVGFilterElement>(resource ? resource->Target() : nullptr);
@@ -545,6 +549,10 @@
return result;
}
+ if (input_tainted || (previous_effect && previous_effect->OriginTainted())) {
+ result->GetSourceGraphic()->SetOriginTainted();
+ }
+
if (!previous_effect)
previous_effect = result->GetSourceGraphic();
SVGFilterBuilder builder(previous_effect, node_map, fill_flags_,
diff --git a/third_party/blink/renderer/core/paint/filter_effect_builder.h b/third_party/blink/renderer/core/paint/filter_effect_builder.h
index 15bd906..d09119bf 100644
--- a/third_party/blink/renderer/core/paint/filter_effect_builder.h
+++ b/third_party/blink/renderer/core/paint/filter_effect_builder.h
@@ -56,7 +56,8 @@
Filter* BuildReferenceFilter(const ReferenceFilterOperation&,
FilterEffect* previous_effect,
- SVGFilterGraphNodeMap* = nullptr) const;
+ SVGFilterGraphNodeMap* = nullptr,
+ bool input_tainted = false) const;
FilterEffect* BuildFilterEffect(const FilterOperations&,
bool input_tainted = false) const;
diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html
new file mode 100644
index 0000000..c7ccf04
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title>Reference for CSS filter: drop-shadow with currentColor on a link</title>
+<style>
+ a {
+ display: block;
+ width: 100px;
+ height: 100px;
+ background-color: green;
+ filter: drop-shadow(0px 0px 0px currentColor);
+ }
+ a:link {
+ color: green;
+ }
+ a:visited {
+ color: red;
+ }
+</style>
+<a href="https://example.com/"></a>
diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html
new file mode 100644
index 0000000..e3d59004
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>CSS filter: drop-shadow with currentColor on a link propagates tainting to subsequent SVG filters</title>
+<link rel="help" href="https://drafts.csswg.org/filter-effects-1/#tainted-filter-primitives">
+<link rel="match" href="reference/tainting-css-dropshadow-currentcolor-ref.html">
+<meta name="fuzzy" content="maxDifference=0-32; totalPixels=32">
+<style>
+ a {
+ display: block;
+ width: 100px;
+ height: 100px;
+ background-color: green;
+ filter: drop-shadow(0px 0px 0px currentColor) url(#dispmap);
+ }
+ a:link {
+ color: green;
+ }
+ a:visited {
+ color: red;
+ }
+</style>
+<svg xmlns="http://www.w3.org/2000/svg" style="display: none">
+ <filter id="dispmap" color-interpolation-filters="sRGB">
+ <feDisplacementMap in="SourceGraphic" in2="SourceGraphic"
+ xChannelSelector="R" scale="200"/>
+ </filter>
+</svg>
+<a href="https://example.com/"></a>
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html
new file mode 100644
index 0000000..c7ccf04
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/tainting-css-dropshadow-currentcolor-ref.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title>Reference for CSS filter: drop-shadow with currentColor on a link</title>
+<style>
+ a {
+ display: block;
+ width: 100px;
+ height: 100px;
+ background-color: green;
+ filter: drop-shadow(0px 0px 0px currentColor);
+ }
+ a:link {
+ color: green;
+ }
+ a:visited {
+ color: red;
+ }
+</style>
+<a href="https://example.com/"></a>
diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html
new file mode 100644
index 0000000..e3d59004
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/tainting-css-dropshadow-currentcolor.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>CSS filter: drop-shadow with currentColor on a link propagates tainting to subsequent SVG filters</title>
+<link rel="help" href="https://drafts.csswg.org/filter-effects-1/#tainted-filter-primitives">
+<link rel="match" href="reference/tainting-css-dropshadow-currentcolor-ref.html">
+<meta name="fuzzy" content="maxDifference=0-32; totalPixels=32">
+<style>
+ a {
+ display: block;
+ width: 100px;
+ height: 100px;
+ background-color: green;
+ filter: drop-shadow(0px 0px 0px currentColor) url(#dispmap);
+ }
+ a:link {
+ color: green;
+ }
+ a:visited {
+ color: red;
+ }
+</style>
+<svg xmlns="http://www.w3.org/2000/svg" style="display: none">
+ <filter id="dispmap" color-interpolation-filters="sRGB">
+ <feDisplacementMap in="SourceGraphic" in2="SourceGraphic"
+ xChannelSelector="R" scale="200"/>
+ </filter>
+</svg>
+<a href="https://example.com/"></a>
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page