I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic that No Users shall be Upload any Image to the Profile picture just for Testing and instead of that i am showing Images like 
`<div style="background-image: url("http://example.com/image.jpg")></div>`

In this i have made a Input for user to place the path of jpg image from any site he likes and I directly display the image from that site only, which is `http://example.com/image.jpg` in our case.

I want to consider the worst situation here, I haven't placed check nor whitelisted any domains into the `example.com/image.jpg`. I placed a URL like `http://stackoverflow.com/index.html` it shows me blank, I tried many PHP scripts like `http://attacker.com/omg.php` and it doesn't run the script on my domain.

Is there any possibility of attack vector here? If yes, kindly suggest me. And also is CORS or SOP Bypass possible here, I have CSP protection of the domain.