Comment on Roundcube Webmail: SVG feImage bypasses image blocking to track email opensparentComments−kijin7moThat's not enough. As the article explains, SVGs can reference external resources. So you also need to prefetch those external resources, recursively, if you want to be thorough.−RobotToaster7moTo add to this, those external resources aren't limited to images, they can be basically anything, foreignObject allows video.I'm also wondering if you could (ab)use SMIL mouse events to bypass this approach.
Comments
That's not enough. As the article explains, SVGs can reference external resources. So you also need to prefetch those external resources, recursively, if you want to be thorough.
To add to this, those external resources aren't limited to images, they can be basically anything, foreignObject allows video.
I'm also wondering if you could (ab)use SMIL mouse events to bypass this approach.