Secure static mode doesn’t block foreignObject. Script execution, external references, declarative animation and interactivity, but not foreign content. Indeed,

Secure static mode doesn’t block foreignObject. Script execution, external references, declarative animation and interactivity, but not foreign content. Indeed, such processing modes are propagated to such foreign content: https://svgwg.org/svg2-draft/conform.html#referencing-modes https://svgwg.org/svg2-draft/conform.html#referencing-modes. See https://news.ycombinator.com/item?id=26922244#26923436 https://news.ycombinator.com/item?id=26922244#26923436 for an example. It works in Chromium.