Which block or blocks?
What reports confirm this?
I only heard about some possible URL embeds that pointed to malicious data, very different from direct malicious media data embeds.