iiinova — where your digital self keeps evolving

Reposted by HamsterOfWrath

Socks the Macro Wolf Dad @socksthewolf.com · 26/09/2026

Okay a tiny thread because people are going to freak out: This exploit in particular takes advantage of a special command that renders images (via attribute escape). If you have an overlay that processes images (most don't) then yes, this is your problem. Overlay must explicitly create img DOM.

A picture of the exploit, using a command that explicitly includes an image file extension, but also would escape out of the src attribute of an image such than an onerror attribute can be added to the img tag. This onerror attribute can run explicit javascript immediately.

Default behavior for most chat widgets is if you have an image it will not attempt to modify image links into actual HTML image tags. Your overlay/overlay service must explicitly be doing this for you.

10541383