diff --git a/src/domain/session/room/timeline/tiles/ImageTile.js b/src/domain/session/room/timeline/tiles/ImageTile.js
index 2d8d912e..ea876b51 100644
--- a/src/domain/session/room/timeline/tiles/ImageTile.js
+++ b/src/domain/session/room/timeline/tiles/ImageTile.js
@@ -20,7 +20,6 @@ const MAX_HEIGHT = 300;
 const MAX_WIDTH = 400;
 
 export class ImageTile extends MessageTile {
-
     constructor(options) {
         super(options);
         this._decryptedThumbail = null;
@@ -34,8 +33,7 @@ export class ImageTile extends MessageTile {
             return;
         }
         // TODO: fix XSS bug here by not checking mimetype
-        // const blob = new Blob([buffer], {type: file.mimetype});
-        return this.track(this._platform.createBufferURI(buffer, file.mimetype));
+        return this.track(this.platform.createBufferURL(buffer, file.mimetype));
     }
 
     async load() {
@@ -52,9 +50,9 @@ export class ImageTile extends MessageTile {
 
     get thumbnailUrl() {
         if (this._decryptedThumbail) {
-            return this._decryptedThumbail.uri;
+            return this._decryptedThumbail.url;
         } else if (this._decryptedImage) {
-            return this._decryptedImage.uri;
+            return this._decryptedImage.url;
         }
         const mxcUrl = this._getContent()?.url;
         if (typeof mxcUrl === "string") {
@@ -70,7 +68,7 @@ export class ImageTile extends MessageTile {
                 this._decryptedImage = await this._loadEncryptedFile(file);
             }
         }
-        return this._decryptedImage?.uri || "";
+        return this._decryptedImage?.url || "";
     }
 
     _scaleFactor() {
diff --git a/src/domain/session/room/timeline/tiles/SimpleTile.js b/src/domain/session/room/timeline/tiles/SimpleTile.js
index 12acd4c5..ec60bbba 100644
--- a/src/domain/session/room/timeline/tiles/SimpleTile.js
+++ b/src/domain/session/room/timeline/tiles/SimpleTile.js
@@ -18,9 +18,9 @@ import {UpdateAction} from "../UpdateAction.js";
 import {ViewModel} from "../../../../ViewModel.js";
 
 export class SimpleTile extends ViewModel {
-    constructor({entry}) {
-        super();
-        this._entry = entry;
+    constructor(options) {
+        super(options);
+        this._entry = options.entry;
     }
     // view model props for all subclasses
     // hmmm, could also do instanceof ... ?
diff --git a/src/platform/web/Platform.js b/src/platform/web/Platform.js
index 1ecae5be..dc299ef8 100644
--- a/src/platform/web/Platform.js
+++ b/src/platform/web/Platform.js
@@ -27,6 +27,7 @@ import {OnlineStatus} from "./dom/OnlineStatus.js";
 import {Crypto} from "./dom/Crypto.js";
 import {estimateStorageUsage} from "./dom/StorageEstimate.js";
 import {WorkerPool} from "./dom/WorkerPool.js";
+import {BufferURL} from "./dom/BufferURL.js";
 
 function addScript(src) {
     return new Promise(function (resolve, reject) {
@@ -127,4 +128,8 @@ export class Platform {
     setNavigation(navigation) {
         this._serviceWorkerHandler?.setNavigation(navigation);
     }
+
+    createBufferURL(buffer, mimetype) {
+        return new BufferURL(buffer, mimetype);
+    }
 }
diff --git a/src/platform/web/dom/BufferURL.js b/src/platform/web/dom/BufferURL.js
new file mode 100644
index 00000000..144acf35
--- /dev/null
+++ b/src/platform/web/dom/BufferURL.js
@@ -0,0 +1,27 @@
+/*
+Copyright 2020 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+export class BufferURL {
+    constructor(buffer, mimetype) {
+        const blob = new Blob([buffer], {type: mimetype});
+        this.url = URL.createObjectURL(blob);
+    }
+
+    dispose() {
+        URL.revokeObjectURL(this.url);
+        this.url = null;
+    }
+}