While JavaScript has many applications, working with string values is one of the most popular. Strings are objects within the JavaScript language. They are not stored as character arrays, so built ...

Basically, the interpreter in the browser ignores the image data and runs the payload string. Researchers at Devcon discovered this trick used in the wild, disguised as a normal BMP file.