libwebp, a Google-originated format... how convenient.

via a crafted HTML page

Don't forget that the majority if not all exploits will use something like JS to obfuscate their existence and frustrate analysis.

Also remember the famous sayings "Those who give up freedom for security deserve neither" and "Live free or die". Accepting the insecurity, because freedom cannot exist without it, is also important.