As some other comment points out, this element has been used to bypass security checks of web based email clients [0]: > Avanan says cybercriminals have found

As some other comment points out, this element has been used to bypass security checks of web based email clients [0]: > Avanan says cybercriminals have found a simple way to bypass this security feature by using a <base> tag in the HTML header – basically splitting the malicious URL. Using this method, Safe Links only checks the base domain and ignores the rest – the link is not replaced and the user is allowed to access the phishing site. To me, this seems more an overlook, if not a bug, of the email link protection system. [0] https://www.securityweek.com/phishers-use-new-method-bypass-office-365-safe-links https://www.securityweek.com/phishers-use-new-method-bypass-...