title: XSS when loading untrusted SVG using img tag
body: <p>Does the threat of XSS exists when loading an untrusted SVG file using the <code>img</code> tag?</p>
  
  <p>As in: <code>&lt;img src="untrusted.svg"/&gt;</code></p>
  
  <p>I've read that most browsers disable scripts in svg files loaded via the <code>img</code> tag.</p>