HTML parser vulnerability