Data URLs are forbidden from

• manifest items
• href attributes in svg and html (except when the document is loaded inside an iframe)

It's also technically forbidden from script window.open and document.open calls, but not sure we can enforce.