Part of the problem (the big one) lies here: "(filters in SVG work on cross-origin resources)" - without it, second attack (more serious) is not possible.