@lispi314 @MostlyHarmless Sure, but I believe such bugs are almost all of the time only exploitable when JavaScript is leveraged to fetch/load the HTML or CSS in succession to carry out the exploit.

Do you have any examples of past HTML exploits?

I suspect a pure HTML/CSS exploit would require loading like a 100MiB HTML file, which takes like 10 minutes to load over tor (I'm going to cancel the loading instead of waiting 10 minutes)