A fix is being released. Thanks for reporting! https://blog.mozilla.org/security/2026/10/20/protecting-fire...
2,893 karma · joined July 8, 2009
Adding formats to the browser gives us more code to maintain, increases the binary size, and increases the attack surface area. That's why, at Firefox, we insisted on a Rust decoder.
The images in the article max out at the maximum size I'd want them displayed.
This isn't true btw. The format supports up to 64k x 64k, although browser decoders currently fail beyond 16k x 16k.
Not sure when you'd serve something like that on a web page though.