[jklmnn] drew inspiration from the work of [Ange Albertini] who has documented a way to hide Javascript within the header of a .gif file. Not only does it carry the complete code but both image ...

"Polyglot exploits are unique in that the file can be an image AND JavaScript at the same time! It also does not need an external script to extract the payload," explain the researchers from Devcon.