3 ms·

Can svg's even do anything malicious with that capability?

• eyelidlessness 6y ago
  Where they can execute JS, they can do so in the same security context as the containing document. So, yeah, they can be used in situ for any privacy or security intrusion that a script tag can.
  • felixfbecker 6y ago
    This is not entirely correct. An SVG file embedded in an <iframe> or <object> is a document itself, and if cross-origin, can not access the outer document. However, if not in a sandboxed iframe, it can still do things like trigger alert prompts or navigation.
    • eyelidlessness 6y ago
      Sorry, this is right. I should have said it’s just as capable or limited in SVG as a bare script tag in the same place.