“booby-trapped message is viewed. "This bug allows remote HTML content to be loaded, replacing the content of the original e-mail message," a user with the GitHub name jansoucek wrote in a readme file accompanying the exploit. "JavaScript is disabled in this UIWebView, but it is still possible to build a functional password 'collector' using simple HTML and CSS [ cascading style sheets ].”