The SVG implementation in Blink as used in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging the use of tree order rather than transitive dependency order for layout.