[eyelidlessness]

I think you can safely embed data URLs because they’re known to be static. What you can’t generally do is trigger a network waterfall or dynamic evaluation from an img tag’s SVG resource.

[aidos]

Gotcha. When thinking of embedded fonts, my mind goes straight to totally embedded with data-uris (which would have worked around OPs issue above).