Time to block webp by default too. It's still a way too immature format to be relied upon. In fact it already was exploitable (via libwebp), AFAIR. :^)