my understanding is that svg in &lt;img&gt; is safe but prevents script execution<p>svg in iframe + srcdoc + sandbox gives you sortof-inline svg with separate security contexts.<p>only plain inlined svg should be a security risk.