That seems to be how one of the exploits from a year or two ago worked. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html htt

That seems to be how one of the exploits from a year or two ago worked. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... It exploited an archaic Xerox format parser to make its own virtual machine, and then went out from there. So I'd agree, throwing anything on a webpage (or incoming message) into the "Can you parse this weird thing?" pipeline is a bad idea!