I want to make something clear: <img src=file.svg> will not execute any scripts nor load foreignObject.
For this to work, the SVG has to be loaded in an iframe or in a new tab. Or it could be inlined in the HTML.
Nothing special about SVG really as long as you (Facebook) treat SVG files as images and don't inline it.
The SVG part only really comes in as a way to hide script tags from anyone looking at the network requests, but even then it seems that the specific SVG was crafted to download further scripts.
So what's the issue here exactly? It seems that Facebook is still somehow affected by XSS? Neat.
The Malwarebytes article[1] explains that the users downloaded (possibly automatically) the SVG files and then opened them in the default viewer, which is MS Edge.
Comments
I want to make something clear: <img src=file.svg> will not execute any scripts nor load foreignObject.
For this to work, the SVG has to be loaded in an iframe or in a new tab. Or it could be inlined in the HTML.
Nothing special about SVG really as long as you (Facebook) treat SVG files as images and don't inline it.
The SVG part only really comes in as a way to hide script tags from anyone looking at the network requests, but even then it seems that the specific SVG was crafted to download further scripts.
So what's the issue here exactly? It seems that Facebook is still somehow affected by XSS? Neat.
The Malwarebytes article[1] explains that the users downloaded (possibly automatically) the SVG files and then opened them in the default viewer, which is MS Edge.
[1] https://www.malwarebytes.com/blog/news/2025/08/adult-sites-t...
Thanks! Yes that would work, just like an .html file would work. The advantages of SVG in this case are
- the OS previews it as an image, but on click it opens a website (which to be fair, once you click on a downloaded file, you're already done)
- SVGs are allowed in any "image/*" form, bypassing certain filters
That doesn't explain anything. Then what?