diff --git a/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js b/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js
index bf543e53f5..11bea8c820 100644
--- a/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js
+++ b/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js
@@ -20,7 +20,9 @@
   // Prevent redefinition.
   if (window.GrDiffBuilderImage) { return; }
 
-  const IMAGE_MIME_PATTERN = /^image\/(bmp|gif|jpeg|jpg|png|tiff|webp)$/;
+  // MIME types for images we allow showing. Do not include SVG, it can contain
+  // arbitrary JavaScript.
+  const IMAGE_MIME_PATTERN = /^image\/(bmp|gif|x-icon|jpeg|jpg|png|tiff|webp)$/;
 
   function GrDiffBuilderImage(diff, prefs, outputEl, baseImage, revisionImage) {
     GrDiffBuilderSideBySide.call(this, diff, prefs, outputEl, []);