77 ms·

So if I intercepted kittens.gif and altered the content type to be 'text/javascript' and the body to be a javascript payload that tries to exploit your browser,

• ryanlol 12y ago
  Not really assuming said gif is inside an img tag.
• pdpi 12y ago
  I'd be more worried about my UA not being able to handle that scenario by just refusing to run that javascript payload.
• lewisl9029 12y ago
  A more realistic situation could be a malicious attacker intercepting the cat picture and replacing it with an image containing something that could land the viewer in jail for having any trace of it on his computer (child pornography), and then sending an anonymous tip to law enforcement...
• IanCal 12y ago
  Not really, since javascript loaded into an image tag shouldn't run and I was already following an unknown link to an unknown location coming from an unknown server. The risk that it was intercepted by you is low, and the consequences seem to be low too. You're also skipping straight over the risk that it happens at all, which is a fairly important part of a risk assessment.