Adult sites are stashing exploit code inside racy .svg files

Generally, browsers try to make it very difficult for the contents of one website to read or interact with the contents of another website. There is a class of attacks called cross site request forgery (CSRF) where website A tries to trick the browser into sending a web request to website B and performing some action which requires authentication. In this case, the action would be to like a Facebook post.

Imagine something really basic like your bank has an endpoint GET shite-bank.com/account/transfer?funds=100&to=myEvilAccount. Website B could try and redirect you to that URL. If you're logged in to shite-bank, then when that request completes you will transfer 100 funds to me. Generally, most websites use various techniques and tokens to prevent other websites from triggering requests like this.

I clicked through the source article, and it sounds like this is specifically a windows thing: original article says that when a windows machine loads the malicious SVG, the malicious JS is parsed in a Microsoft Edge browser process, regardless of the browser a user visited the porn site with (apparently all Windows SVGs load through Edge). I would guess that there is some aspect of this context switch which enables the CSRF attack to work, but it is not explained in the original article.

Unlike more common formats such as .jpg or .png, .svg uses XML-based text to specify how the image should appear, allowing files to be resized without losing quality due to pixelation. But therein lies the rub: The text in these files can incorporate HTML and JavaScript, and that, in turn, opens the risk of them being abused for a range of attacks, including cross-site scripting, HTML injection, and denial of service.

Willing to bet that some browsers just do what the SVG says.

svg are treated the same as webpages by modern browsers. Either integrated into the dom directly, or as a sort of sub page. Not much potential for exploits you couldn't do in html.

This should mostly be about injection, so someone else uploading a picture to a page and taking it over for other users. Just loading that image might make your account follow some profile there, or even do some action like press a share button.

I can't tell if you're being serious or just making a joke.