@lispi314 @MostlyHarmless >CVEs for transport, image renderers & such are present for 2014, 2015 and 2016 that could've been turned into code execution (or demonstrably were).
Tor browser is pretty good, as it can disable dangerous formats to render, for example SVG.

The image renders firefox uses have improved and have undergone fuzz testing I believe.

I wonder if there's an option to disable image rendering...