>>279897559
whenever you open up access to "the web" in general it's a bag of worms. VRChat when it was much smaller had web panels that could do literally anything and most worlds used them for all kinds of things. The issue is javascript and other exploits running in a privileged binary - and it was shown you could basically root someone's machine. 
Now, they've added audiovideo and streaming streaming audiovideo loading from external urls, which is no big deal and fairly safe, and you can use that to populate a render texture and then do shader tricks to fill out cards, but it's roundabout. I don't imagine they won't implement something in the very near future though, they're just cautious about web. 

That being said: For something like getting all the mtg faces, you would be MUCH better served by writing a simple script that snags them all for you once and imports them as images into your unity scene, that you can crunch compress and optimize visually before you upload an update to vrchat's servers. It's much better to have the assets static and part of your map, than trusting an external site which would massively hitch the load for players when they get it, every time. All you would need to do is publish an update to your map whenever a new set comes out, which would take a couple seconds to do.