# Adult sites are stashing exploit code inside racy .svg files

**URL:** https://discuss.privacyguides.net/t/adult-sites-are-stashing-exploit-code-inside-racy-svg-files/29896
**Category:** News
**Tags:** article
**Created:** 2025-08-09T10:28:30Z
**Posts:** 1

## Post 1 by @Machkiel — 2025-08-09T10:28:30Z

> Dozens of porn sites are turning to a familiar source to generate likes on Facebook—malware that causes browsers to surreptitiously endorse the sites. This time, the sites are using a newer vehicle for sowing this malware—.svg image files.
> 
> The Scalable Vector Graphics format is an open standard for rendering two-dimensional graphics. Unlike more common formats such as .jpg or .png, .svg uses XML-based text to specify how the image should appear, allowing files to be resized without losing quality due to pixelation. But therein lies the rub: The text in these files can incorporate HTML and JavaScript, and that, in turn, opens the risk of them being abused for a range of attacks, including cross-site scripting, HTML injection, and denial of service.

> **[Adult sites are stashing exploit code inside racy .svg files](https://arstechnica.com/security/2025/08/adult-sites-use-malicious-svg-files-to-rack-up-likes-on-facebook/)**
>
> Running JavaScript from inside an image? What could possibly go wrong?

Supposedly, Celenityy BadBlock and its more specific “Block SVG” include a uBlock Origin blocklist for SVG:

> **[GitHub - celenityy/BadBlock: Cleaning up the internet, one domain at a time.](https://github.com/celenityy/BadBlock)**
>
> Cleaning up the internet, one domain at a time.