Question: Are favicons a security risk?
Answer:
In general, using the favicon.ico on your Web pages does not pose a security risk, but there are some issues you should be aware of:
- Do not call your favicon.ico with a javascript in the link tag. This could be used to run or install malicious software. (Source Mozilla Foundation Security Advisory 2005-37
- There is an issue with the Opera browser 7.5 (and lower) that allows information to be spoofed through the favicon. This doesn't affect Web developers, but rather Opera users themselves. (Source: Secunia
- There is a concern that the fact that the favicon was originally requested primarily when a customer bookmarked the site that this could allow Web developers to track who was bookmarking their sites and possibly build profiles of their users. This would invade the privacy of anyone bookmarking a site with Internet Explorer. However, this issue has become less serious now that numerous browsers request the favicon immediately upon entering a site to load it in the address bar or tab bar. (Source: Security Information Week
