The JPEG Trick That Lets One Image Turn Into Another While It Loads

Most of us have never thought about what happens the moment we click on a picture. A progressive JPEG — the standard format that powers millions of images on the web — doesn't arrive all at once. It trickles in through a sequence of scans: first a blurry low-resolution sketch, then gradually sharper and sharper, until the final frame resolves into a crisp photograph. Each scan is a fully valid image on its own, and the browser simply paints the newest one over the old.

How the Trick Works

A security researcher recently uncovered a quirky side effect of this design. Because each scan explicitly declares its own spectral frequency range and the browser renders everything up to the last scan it receives, nothing stops you from stitching two entirely different JPEGs together into a single file. You take one image, then tack on the progressive-scan headers of a second image right behind it. As the browser downloads the file, it faithfully renders the first picture — a cat, for instance — and then, seconds later, swaps it out for the second — perhaps a dog — with no warning, no error, no flicker that signals something is amiss.

Why It Matters

The implications stretch far beyond a neat parlor trick. An attacker could serve an image that appears harmless when shared on social media but silently morphs into something malicious once loaded in a browser. Ejected into memes and viral posts, it erodes a basic layer of trust: the assumption that a picture you saw five seconds ago is still the picture on your screen. For anyone who relies on visual evidence — journalists, moderators, fact-checkers — the damage is subtle but real.

Patched For Now

The response from browser vendors has been swift. Chromium, Firefox, and Safari have all shipped patches that reject concatenated JPEGs whose scan headers contradict the first image's baseline, effectively closing the loophole. The technique survives in the wild as a cautionary tale — a vivid reminder that even decades-old standards like JPEG still hold secrets we haven't quite finished uncovering.