Why plain text email, 2026 edition

Gareth Heyes, CSS: the bomb inside your inbox : "It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this paper I'm going to show you how to break out of trust boundaries, exfiltrate tokens, compromise 3rd party websites and even steal passwords." Previously: 2001: Why HTML in E-Mail is a Bad Idea 2002: 7 reasons…