[hughes]

Looks like it's not sandboxed at all?

> Any functions defined within any script element have a global scope across the entire current document.

[0] https://developer.mozilla.org/en-US/docs/Web/SVG/Element/scr...

[spb]

As images / targets, SVG documents have their own global scope, much like a page in an iframe.