User generated content (especially images) are a great attack vector, what do you do to isolate/mitigate against attacks like that ?.
Similarly, browsers should not generally be particularly vulnerable to malicious content being loaded with appropriate MIME types in appropriate containers (e.g. <img>)
It sounds like you should be asking how browsers protect users from malicious content. Perhaps you could elaborate?
In this context the image manipulation they do with pillow and the underlying libjpeg would be a potential source of vulnerabilities.