The vulnerability can be exploited by loading an HTML page that uses specially crafted CSS code. The CSS code ... and HTML-capable apps listed on the App Store to use its WebKit rendering engine ...

Turns out, all it takes for attackers to alter the "external sender" warning, or remove it altogether from emails is just a few lines of HTML and CSS code ... senders can use to circumvent ...