This can't be used for XSS or the like, really. The way it works is that the PNG is first interpreted as HTML by the browser (hence the filename) and then it l

This can't be used for XSS or the like, really. The way it works is that the PNG is first interpreted as HTML by the browser (hence the filename) and then it loads itself into an image tag, causing it to be interpreted as a PNG. Once it's loaded into the image tag, the image is drawn to a canvas so that the code -- embedded in the PNG -- can be extracted and executed. While fun, the only real security concern here is that it's really good at pissing off IDSes. Edit: I linked my article describing the technique in another comment here if you want to see how horrible it really is. I'm always both proud of and disgusted by myself for this technique.