Suppose the website is just HTML.
CVE-2026-17710 was published July 30th, 2026. It reads:
Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Or CVE-2026-9999, published May 28th, 2026. It reads:
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Or CVE-2026-9984, also published May 28th, 2026. It reads:
Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Searching “html” on cve.org currently nets 132,136 results. The “untrusted input” I was referring to in my other answer[1] includes HTML. It includes anything and everything you receive from a website. If you know a website is malicious, it is always going to be risky visiting it. There is no way to guarantee absolute safety visiting any website ever; realistically, the best you can do is use up-to-date software, avoid suspicious websites, and avoid clicking on links or downloading things.