MCP server CSS feConvolveMatrix security: saturating kernel divisor attack, bias offset whitewash, zero-sum alpha zeroing via preserveAlpha=false, and large-order blur bypass

Published 2026-10-01 — SkillAudit Research

The SVG feConvolveMatrix filter primitive applies a two-dimensional matrix convolution to each channel of the input image. For each output pixel at coordinates (x, y), the output channel value is computed as the weighted sum of input channel values in a neighborhood defined by the kernel size, divided by a normalization factor, plus an optional bias term:

C'(x,y) = (∑ kernelMatrix[i,j] × C(x - targetX + i, y - targetY + j)) / divisor + bias

The key parameters are order (kernel dimensions, e.g., "3 3" for a 3×3 kernel), kernelMatrix (the n² coefficient values as a space-separated list), divisor (the normalization factor — defaults to the sum of absolute kernel values if that sum is non-zero, else 1), bias (a constant added to every output pixel per channel), preserveAlpha (if "true", the alpha channel bypasses the convolution), and edgeMode (how boundary pixels are handled: duplicate, wrap, or none).

Convolution output formula

For a 3×3 kernel with all entries equal to 1.0 and divisor="1": each output pixel accumulates 9 input pixel values and divides by 1, producing values up to 9.0. Channel values are clamped to [0.0, 1.0] after computation — so 9.0 clamps to 1.0 (white). The default divisor of 9 would normalize this to an average, but divisor="1" eliminates normalization, guaranteeing saturation.

Attack findings

<filter id="f1">
  <feConvolveMatrix order="5" kernelMatrix="1 1 1 1 1  1 1 1 1 1  1 1 1 1 1  1 1 1 1 1  1 1 1 1 1"
    divisor="1" preserveAlpha="false"/>
</filter>

<filter id="f1">
  <feConvolveMatrix order="3"
    kernelMatrix="0 0 0  0 1 0  0 0 0"
    divisor="1" bias="0.92" preserveAlpha="false"/>
</filter>

<!-- Laplacian kernel: sum = 0 → alpha of uniform region → 0 -->
<filter id="f1">
  <feConvolveMatrix order="3"
    kernelMatrix="0 1 0  1 -4 1  0 1 0"
    divisor="1" preserveAlpha="false"/>
</filter>

Detection algorithm

function detectFeConvolveMatrixAttacks(consentEl) {
  const style = getComputedStyle(consentEl);
  const filterVal = style.filter;
  if (!filterVal || filterVal === 'none') return null;

  const filterId = filterVal.match(/url\(["']?#([^"')]+)["']?\)/)?.[1];
  if (!filterId) return null;

  const svgRoot = consentEl.closest('svg') || document;
  const filter = svgRoot.querySelector(`filter#${filterId}`);
  if (!filter) return null;

  const fillColor = style.fill || style.color || 'rgb(26,26,26)';
  const [srcR, srcG, srcB] = parseCSSColor(fillColor);

  const findings = [];

  for (const cm of filter.querySelectorAll('feConvolveMatrix')) {
    const orderAttr = cm.getAttribute('order') || '3';
    const [orderX, orderY] = orderAttr.trim().split(/\s+/).map(Number);
    const n = (orderX || 3) * (orderY || orderX || 3);

    const kernelStr = cm.getAttribute('kernelMatrix') || '';
    const kernel = kernelStr.trim().split(/\s+/).map(Number);
    if (kernel.length !== n) continue;

    const kernelSum = kernel.reduce((a, b) => a + b, 0);
    const kernelAbsSum = kernel.reduce((a, b) => a + Math.abs(b), 0);
    const divisorAttr = cm.getAttribute('divisor');
    const divisor = divisorAttr ? parseFloat(divisorAttr) :
      (kernelAbsSum > 0 ? kernelAbsSum : 1);
    const bias = parseFloat(cm.getAttribute('bias') ?? '0');
    const preserveAlpha = cm.getAttribute('preserveAlpha') === 'true';

    // Check bias attack: constant offset pushes dark text to white
    if (bias > 0.5) {
      const worstCase = srcR + bias; // assuming center pixel dominates
      if (worstCase >= 0.9) {
        findings.push({ severity: 'critical', el: cm,
          issue: `feConvolveMatrix bias="${bias}" pushes dark channel values (${srcR.toFixed(2)}) to ${Math.min(1, worstCase).toFixed(2)} — near-white output, contrast <1.5:1 against white` });
      }
    }

    // Check saturation attack: all-positive kernel with divisor=1 or small divisor
    const allPositive = kernel.every(v => v >= 0);
    if (allPositive && kernelSum > 0) {
      const maxOutput = kernelSum / divisor + bias;
      if (maxOutput > 0.9) {
        findings.push({ severity: 'critical', el: cm,
          issue: `feConvolveMatrix: all-positive kernel sum=${kernelSum.toFixed(1)}, divisor=${divisor.toFixed(1)} → max output=${maxOutput.toFixed(2)}; interior pixels saturate to white` });
      }
    }

    // Check zero-sum alpha zeroing via preserveAlpha=false
    if (!preserveAlpha && Math.abs(kernelSum) < 0.01 && bias === 0) {
      findings.push({ severity: 'high', el: cm,
        issue: `feConvolveMatrix: zero-sum kernel (sum=${kernelSum.toFixed(4)}) with preserveAlpha=false — uniform-alpha consent text regions output alpha=0, element becomes transparent` });
    }

    // Check Gaussian blur approximation (wide kernel, positive entries, normalized)
    if (n >= 25) { // 5×5 or larger
      const centerWeight = kernel[Math.floor(n / 2)] / divisor;
      if (centerWeight < 0.3) {
        findings.push({ severity: 'medium', el: cm,
          issue: `feConvolveMatrix: large kernel (${Math.sqrt(n).toFixed(0)}×${Math.sqrt(n).toFixed(0)}) with low center weight ${centerWeight.toFixed(3)} — Gaussian blur approximation destroys glyph spatial frequency; not detected by feGaussianBlur checks` });
      }
    }
  }

  return findings.length ? findings : null;
}

function parseCSSColor(css) {
  const m = css.match(/rgb\((\d+),\s*(\d+),\s*(\d+)\)/);
  return m ? [parseInt(m[1])/255, parseInt(m[2])/255, parseInt(m[3])/255] : [0.1, 0.1, 0.1];
}

Remediation