@Suiseiseki @MostlyHarmless There are the odd exploitable bugs in HTML/CSS parsing and rendering & such, from time to time, unfortunately.

So while not executing arbitrary Javascript code is a good step, it only removes most of the common attack surface, not all of it.