SVGs embedded through HTML img should be self-contained

SVGs used through an HTML <img> should embed every required raster, font, and style resource or be rendered into standalone PNGs. Chromium treats an SVG loaded as an image as a restricted image document, so nested local file references may not load even when every path exists; the vectors can appear over a black or empty background. This applies to portable review reports and exported evidence bundles. It is less relevant to inline SVG markup in the parent DOM, where resource-loading behavior differs, but self-contained assets remain safer.

A robust verification decodes each embedded data URI and compares it with the intended source hash, asserts that no external SVG resource references remain, parses every SVG, and checks that all parent-HTML asset paths resolve. A browser render remains the final visual check when browser control is available.

Evidence/example — 2026-09-09

A local detector-review report showed annotations without its JPEG backgrounds because generated SVGs referenced sibling JPEGs and were themselves embedded via HTML <img>. Regenerating nine SVGs with embedded JPEG data URIs removed every nested dependency; all decoded payloads matched their source-image hashes. Provenance: user Chromium observation plus local generator/static-asset inspection. No customer data, image content, or private artifact paths included.