Geary

Geary renders HTML email through libwebkit2gtk-4.1-0, pinned to WebKitGTK 2.44 — a series upstream no longer issues security fixes for. Every WebKitGTK advisory since the 2.46 branch is unapplied.

HTML email is attacker-chosen content that arrives unsolicited, so this is a lower bar to clear than visiting a bad site. The pin exists because 2.46+ need C++23 features the iOS Clang 14 toolchain does not have.

If you use it, prefer plain-text display and be wary of mail from senders you do not know.