[lmm]

If you trust your browser it's fine, and if you don't then both CSS and SVG are significantly more risky.

[margalabargala]

This isn't true at all.

Anything SVG does maliciously, it does by containing JavaScript, so SVG's worst case is a subset of JS's.

[fc417fc802]

Remind me again what the ratio of browser sandbox escapes coupled with full RCE is between JS, CSS, and SVG?

[sysguest]

> then both CSS and SVG are significantly more risky.

how???