I’ve tried blocking svg but they are used a lot more than you would think in footers. Blocking by hash just isn’t feesible at scale. We need an inspector that’s not a sandbox. Something lighter that checks for executeable code in them.

There’s a lack of information on systems affected.