MCP server SVG feBlend mode=exclusion consent security

The feBlend SVG filter primitive's mode="exclusion" formula is defined in W3C Compositing and Blending Level 1 as out = Cs + Cb − 2 × Cs × Cb, where C_s is the source (in1, the consent element rendered as SourceGraphic) and C_b is the backdrop (in2, attacker-controlled via feFlood). All values are normalized to [0,1] in linear RGB. The formula is symmetric — swapping in1 and in2 produces identical output — and its behaviour depends critically on the value of C_b.

Three special cases dominate the attack surface. At C_b=0: out = Cs + 0 − 0 = Cs — identity, no modification. At C_b=0.5: out = Cs + 0.5 − Cs = 0.5 — constant output, all pixels become mid-gray regardless of source. At C_b=1: out = Cs + 1 − 2Cs = 1 − Cs — inversion of the source channel. These three analytical fixed points define which in2 values are attacks (C_b=1 and C_b=0.5) versus inert (C_b=0).

The exclusion formula: four key analytical properties

Understanding the formula out = Cs + Cb − 2CsCb analytically before examining individual attacks clarifies the full detection space.

Exclusion formula (W3C compositing-1):
  out = Cs + Cb - 2 × Cs × Cb

Property 1 — Symmetry:
  out(Cs, Cb) = Cs + Cb - 2CsCb = Cb + Cs - 2CbCs = out(Cb, Cs)
  Swapping in1/in2 produces identical output.

Property 2 — Identity at Cb=0 (black in2):
  out = Cs + 0 - 2×Cs×0 = Cs
  Black in2 → output equals source; NO attack.

Property 3 — Constant output at Cb=0.5 (mid-gray in2):
  out = Cs + 0.5 - 2×Cs×0.5 = Cs + 0.5 - Cs = 0.5
  ALL output pixels → 0.5 regardless of Cs; constant-output attack.

Property 4 — Inversion at Cb=1 (white in2):
  out = Cs + 1 - 2×Cs×1 = 1 - Cs
  Output is the complement of source; dark text (Cs≈0.04) → 0.96 (near-white).

Sensitivity near Cb=0.5:
  d(out)/d(Cb) at fixed Cs = 1 - 2Cs
  For dark text Cs=0.04: d(out)/d(Cb) = 0.92; output is highly sensitive to Cb near 0.5.

SA-CSS-EXC-001: feBlend mode="exclusion" with white in2 (dark text inverted to near-white)

A feFlood with flood-color="white" sets C_b=1 per channel in linearRGB. Applying the exclusion formula: out = Cs + 1 − 2Cs = 1 − Cs. Dark consent text with C_s≈0.04 linearRGB (approximately #333333 in sRGB) produces out = 1 − 0.04 = 0.96 — a near-white value. Against a white or light background, this renders as invisible. Lighter dark text (e.g., #555555, C_s≈0.09) yields out = 0.91, still near-white. Any dark foreground with C_s<0.1 will produce out>0.9 — effectively invisible on light backgrounds.

<filter id="exclusion1">
  <feFlood flood-color="white" flood-opacity="1" result="whiteBackdrop"/>
  <feBlend in="SourceGraphic" in2="whiteBackdrop" mode="exclusion"/>
</filter>
<!-- With Cb=1 (white): out = 1 - Cs (inversion formula) -->
<!-- Dark text Cs≈0.04 (#333): out = 1-0.04 = 0.96 (near-white) -->
<!-- WCAG: relative luminance 0.96 vs white bg 1.0: (1.05)/(0.96+0.05) ≈ 1.04:1 -->
<!-- getComputedStyle().color still reports original #333333; filter invisible to DOM -->
<!-- IMPORTANT: output is NOT constant — it varies with Cs (inversion); -->
<!-- constant-output detectors that check max-min output range will miss this attack -->

A critical detection consideration: this is an inversion attack, not a constant-output attack. The output varies with C_s — different input text colors produce different near-white outputs. A detector that identifies constant-output feBlend configurations (output range max−min < 0.1 across all C_s) will correctly flag EXC-002 but will miss EXC-001. Detection for EXC-001 must evaluate: for the expected foreground color C_s of the consent element, does the exclusion formula with the observed C_b produce out>0.9 (near-white) while the page background is light (luminance>0.8)? If so, flag inversion white-out.

SA-CSS-EXC-002: feBlend mode="exclusion" with mid-gray in2 (Cb=0.5 linearRGB, constant output)

When the feFlood sets C_b=0.5 in linearRGB, the exclusion formula reduces to a constant: out = Cs + 0.5 − 2Cs×0.5 = Cs + 0.5 − Cs = 0.5. Every output pixel becomes exactly mid-gray (0.5 linearRGB), regardless of the source. Dark consent text (#333), mid-gray text (#888), and light text (#ccc) all render identically as a flat mid-gray field. This is a true constant-output attack — the output carries zero information from the source.

<filter id="exclusion2">
  <!-- #bcbcbc: sRGB=0.737 → linearRGB≈0.502 ≈ 0.5; exact constant-output condition -->
  <feFlood flood-color="#bcbcbc" flood-opacity="1" result="midGrayBackdrop"/>
  <feBlend in="SourceGraphic" in2="midGrayBackdrop" mode="exclusion"/>
</filter>
<!-- Cb≈0.5 linearRGB: out = Cs + 0.5 - Cs = 0.5 for ALL Cs values -->
<!-- Dark text Cs=0.04 → out=0.5; mid-gray text Cs=0.5 → out=0.5; light text → out=0.5 -->
<!-- WCAG on white background (luminance=1): (1+0.05)/(0.5+0.05) = 1.05/0.55 ≈ 1.91:1 -->
<!-- WCAG AA requires 4.5:1; WCAG AAA requires 7:1; both fail -->
<!-- On mid-gray background (luminance≈0.5): (0.55)/(0.55) = 1:1 — total failure -->
<!-- #808080 ≠ Cb=0.5 linearRGB; #808080 gives Cb=0.216 lRGB → not constant-output -->

On a white background (linearRGB luminance=1.0), the WCAG 2.1 relative luminance contrast between mid-gray output (0.5) and white is (1.0+0.05)/(0.5+0.05) = 1.05/0.55 ≈ 1.9:1 — far below the WCAG AA threshold of 4.5:1. On a mid-gray background matching the output, contrast is 1:1. On a dark background (#1e1e2e, common in AI agent installer themes), the contrast between mid-gray and dark is somewhat higher but the consent text still carries no semantic information since all characters render identically.

SA-CSS-EXC-003: feBlend mode="exclusion" with black in2 (identity — not an attack)

A feFlood with flood-color="black" sets C_b=0 per channel. The exclusion formula gives: out = Cs + 0 − 2Cs×0 = Cs. The output equals the source — exclusion with black in2 is a pure identity transform. The consent element renders with its original colors and contrast completely intact. This is not an attack.

<filter id="exclusion3">
  <feFlood flood-color="black" flood-opacity="1" result="blackBackdrop"/>
  <feBlend in="SourceGraphic" in2="blackBackdrop" mode="exclusion"/>
</filter>
<!-- Cb=0 (black): out = Cs + 0 - 2×Cs×0 = Cs (identity) -->
<!-- Dark text Cs=0.04 → out=0.04; original color preserved; NO attack -->
<!-- This contrasts with mode=darken (black in2 → forces all to black = attack) -->
<!-- and mode=overlay/hard-light (black in2 → attacks light text) -->
<!-- Exclusion-specific detection logic required; generic "dark in2 = suspicious" false-positives here -->

SA-CSS-EXC-004: JS mousedown mutates feFlood flood-color from Cb=0 to Cb=0.5 (click-time constant-output)

The initial filter state has the feFlood at flood-color="black" (C_b=0). By the identity property (EXC-003), the consent element renders correctly — the exclusion filter is inert. The feBlend mode attribute remains "exclusion" throughout; the mode never changes. On mousedown, the script mutates only the feFlood flood-color attribute from black to "#bcbcbc" (C_b≈0.5 linearRGB). The constant-output condition activates: all pixels collapse to 0.5 mid-gray. Consent text becomes unintelligible.

consentElement.addEventListener("mousedown", () => {
  const flood = document.getElementById("exclusionFilter")
                         .querySelector("feFlood");
  // Switch flood-color from identity (Cb=0) to constant-output (Cb≈0.5 linearRGB)
  flood.setAttribute("flood-color", "#bcbcbc");
  // feBlend mode="exclusion" is unchanged throughout — mode-only observer misses this
  // Before: out=Cs (identity); After: out=0.5 (constant mid-gray) for all Cs
  // User perceives correct consent text before click; flat gray field during click
});

This attack is particularly stealthy because the mutation target is the flood-color attribute on a feFlood child element — not the mode attribute on the feBlend element itself. A MutationObserver configured to watch feBlend attribute changes (the typical implementation for detecting SA-CSS-BDL-004 and SA-CSS-BCB-004 click-time attacks) will not fire. The observer must specifically monitor feFlood elements that supply in2 to feBlend mode="exclusion" primitives within consent ancestor filters. Both flood-color and flood-opacity attributes on those feFlood nodes require observation, since flood-opacity<1 also shifts the effective C_b.

// Correct MutationObserver implementation for exclusion flood-color attacks:
const filter = consentElement.closest("[filter]");
const filterId = filter?.getAttribute("filter")?.match(/url\(#([^)]+)\)/)?.[1];
const filterEl = document.getElementById(filterId);
if (!filterEl) return;

filterEl.querySelectorAll("feBlend[mode='exclusion']").forEach(blend => {
  const in2Id = blend.getAttribute("in2");
  const in2El = filterEl.querySelector(`[result='${in2Id}']`);
  if (in2El?.tagName === "feFlood") {
    // Watch flood-color AND flood-opacity on this feFlood
    new MutationObserver(mutations => {
      for (const m of mutations) {
        if (m.attributeName === "flood-color" || m.attributeName === "flood-opacity") {
          // Re-evaluate Cb in linearRGB; check for Cb≈0.5 or Cb≈1 attack condition
          auditExclusionFilter(blend, in2El);
        }
      }
    }).observe(in2El, { attributes: true });
  }
});

Attack summary

Defences

• Exclusion-specific formula evaluation: For any feBlend mode="exclusion" in a consent ancestor filter, identify the in2 source. If in2 is a feFlood, parse the flood-color to linearRGB channel values C_b. Evaluate out = Cs + Cb − 2CsCb for the expected consent foreground (C_s≈0.05 for dark text). If out>0.9 (inversion white-out, EXC-001): flag. If output range across all C_s values [0,1] is less than 0.1 (constant-output, EXC-002): flag.
• sRGB-to-linearRGB conversion is mandatory: The constant-output condition occurs at C_b=0.5 linearRGB, which corresponds to flood-color #bcbcbc — not #808080. Do not evaluate feFlood colors in sRGB space; apply the IEC 61966-2-1 sRGB EOTF to each channel before substituting into the exclusion formula.
• Do not flag black in2 for exclusion: C_b=0 produces identity for exclusion. A rule that flags feBlend mode=exclusion with dark in2 will generate false positives. Exclusion detection logic must be isolated from darken/overlay/hard-light logic that does flag black in2.
• Inversion detection requires context: EXC-001 produces near-white output (out≈0.96) for dark text. This is not constant-output — the output value varies with C_s. Detection must evaluate the specific expected foreground color against the page background luminance, not just check for constant output. If out>0.9 AND page background luminance>0.8: flag as white-out inversion attack.
• MutationObserver must target feFlood flood-color, not feBlend mode: The EXC-004 attack mutates the feFlood flood-color attribute while leaving the feBlend mode unchanged. MutationObservers watching only the feBlend node's attributes will not detect this transition. The observer must be placed on feFlood nodes that supply in2 to any feBlend mode=exclusion primitive within a consent ancestor filter. Watch both flood-color and flood-opacity attributes on those feFlood nodes.
• Sensitivity near Cb=0.5: The output sensitivity d(out)/d(C_b) at C_s=0.04 is 0.92 — small changes in C_b near 0.5 produce large changes in output. ML-based or heuristic detectors trained on exact-value thresholds may be unstable in this region. Use absolute formula evaluation rather than approximate gradient-based heuristics.

SkillAudit findings for this attack surface

← Blog  |  Security Checklist