Comment by wbxrs

A website cannot tell a browser to "load malware", unless we're talking about a exploit, which should be patched.

(Please don't say "if I send you a malformed png file you have to execute the exploit, otherwise your argument breaks down".)