An attacker can send a specially crafted email that, when opened by a user under certain conditions, executes arbitrary JavaScript in the browser context. "Improper neutralization of input during web ...