Reading the article, I kept thinking: "could you defeat this with an iframe?", and indeed:

> One of the best methods to protect against these attacks is strict isolation. If you isolate the email message using sandboxed iframes you restrict the ability to break out of trusted boundaries. If you are not using sandboxed iframes, always be careful when allowing custom attributes and check for HTML/CSS gadgets. Use a strict allow list of characters when validating keywords and names to avoid mutation when using the CSSOM.

iframes should be the first layer of any defense-in-depth against user-submitted content.

One thing I've found that purports to address (some of) these risks: https://mail.cock.li/cock-mail/

Haven't tried it yet though, done some reading but don't know enough to be sure their proposed paradigm is valid.

This website was pretty nasty to my browser history and pretty much kidnapped my tab on mobile safari.

Would a hard isolation model for HTML email be a better long-term solution, or is that impractical for reasons I’m missing?

I view email in Thunderbird and have uBlock installed. Sadly the CSS Exfil addon for Firefox does not exist for Thunderbird but I view emails in plain text either way. I suppose I "miss out" on backgrounds, themes, animated GIFs. For me personally plain text is the way to go. Am I the only one using an email client these days? I prefer the client so I can keep my emails off the server and manage my own backups.

> This page requires JavaScript for an enhanced user experience.

Yeah no shit.

> In this section I targeted Fastmail, ProtonMail, Gmail, Cowork and Slack.

Oh that's all, is it?

Allowing anything other than plain text in email bodies was a terrible mistake.