Why plain text email, 2026 edition

Gareth Heyes, CSS: the bomb inside your inbox:

"It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this paper I'm going to show you how to break out of trust boundaries, exfiltrate tokens, compromise 3rd party websites and even steal passwords."

Previously:

• 2001: Why HTML in E-Mail is a Bad Idea

• 2002: 7 reasons why HTML e-mail is EVIL

• 2004: HTML email considered harmful | use plain text email

• 2006: Force Apple Mail to Display Incoming Messages as Plain Text

• 2009: Just say no to HTML email and proprietary attachments

• 2011: Test your mail client's leakiness

❧ 2026-08-07