Refactoring a website to be compatible with "safest" setting, but wasn't able to find documentation of this feature.

Edit: Found how... about:config => svg.disabled => true.

  • Please don't add an answer to your question. Instead add it as anwer.
    – Jens Kubieziel
    Apr 7 '21 at 20:17
  • Thanks for the feedback @JensKubieziel... that being said, I don't understand... First you recommended not adding an answer and then to "add it as answer". Puzzled.
    – sunknudsen
    Apr 8 '21 at 13:22
  • @sunknudsen, he meant posting the solution as an answer.
    – Swangie
    Apr 15 '21 at 23:46

How the Tor browser disables SVG images:

The Tor browser design and implementation document states for the high security preference:

This security level inherits the preferences from the Medium level, and additionally disables remote fonts (noscript.forbidFonts), completely disables JavaScript (by unsetting noscript.globalHttpsWhitelist), and disables SVG images (svg.in-content.enabled).

However, I have reason to believe this is false and this document is not up to date.

The Tor Browser now disables SVG images by setting svg.disabled to true. I verified this to be the case when I checked the status of svg.disabled. It showed up as true for safest security level and false for any other security level.

Why the Tor browser does this:

SVGs create vulnerabilities including XSS attacks (Cross-Site-Scripting), HTML injection, The Billion Laughs Attack, DOS attacks, etc.

See more here:


Figured out why... see https://www.fortinet.com/blog/threat-research/scalable-vector-graphics-attack-surface-anatomy.

In a nutshell, SVGs add a lot of attack surface including scripting and injection attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.