@Hoss @Forestofenchantment @creamqueen @rher re: webp, the big problem with webp is very simple: there's only one real implementation which is libwebp, and that has been exploited in the past.

Exploiting image libraries outside of webp is a very real thing. Back in the PSP days there was an exploit called ChickHEN which would exploit the PSP firmware to allow custom binaries to be loaded (way before the signing key leak would be the "checkmate" for PSP hacking).

Before that, there were several other libtiff exploits, including one used to hack the PSP and the iPhone and it was one of the earliest iOS exploits.
https://theapplewiki.com/wiki/LibTiff_Exploit