tl;dr: Color Profile Injection is due to untrusted inputs within color profile blobs. Updated 13-AUG-2026: From the WASM Draft Security Model just Published: When the ICC Tools are compiled to WASM then integrated into a browser, attacker-controlled profile metadata or generated outputs may be rendered in the DOM. If the application inserts this data into … Continue reading Color Profile Injection (CPI)