3 ms·

What's the hole? Neither appear to say.

• throwaway290 1y ago
  I guess that obfuscated JS in SVG runs? Then it downloads the script that does shady stuff
  • lostmsu 1y ago
    That does not explain exactly what is wrong. The site could already run JS. It did not need SVG to do it.
    • throwaway290 1y ago
      Yeah I guess the original article is not clear on that. Other cases usually involved email but this is not