There are other potential attack vectors than buffer overflows, though that seems the most likely source of vulnerabilities if you&#x27;re going to limit images to JPG or PNG.<p>Of course now you&#x27;re not only prohibiting third party resources except images, you&#x27;re even prohibiting modern image formats like SVG, which is a little ironic since SVG-based ads might be smaller and&#x2F;or look cleaner than equivalent bitmaps.