https://www.schneier.com/blog/archives/2018/05/details_on_a_ne.html > 2. The vulnerability isn't with PGP or S/MIME itself, but in the way > they interact with modern e-mail programs. You can see this in the > two suggested short-term mitigations: "No decryption in the e-mail > client," and "disable HTML rendering." -- Rich P.