Email clients shouldn't be more vulnerable than browsers these days, since I think most email clients use a browser rendering engine for HTML emails now anyway.

Email clients shouldn't be more vulnerable than browsers these days, since I think most email clients use a browser rendering engine for HTML emails now anyway. There is always the risk of another WMF-style exploit though.