CyberSIXT Search
Original
Image: SANS ISC

SANS ISC

Outlook Junk preview fails to show links missing URI scheme

Outlook’s Junk folder can helpfully show where links lead by stripping formatting, but a simple bypass was reported that prevented the preview from displaying certain links. The author found that when a message is placed in Junk, the HREF may be missing a valid URI scheme, containing only the path segment, so the link preview pane fails to parse it even though the link remains clickable when the message is opened normally.

He notes that the link’s preview mechanism is not as dependable as previously believed, and adds a caveat based on a phishing message encountered in April. The insights were published on 14 May 2026, according to Internet Storm Center, with the explanation supported by screenshots and references to RFC 3986. The explanation emphasises that while the preview can aid safety checks, it should not be relied upon for determining link validity in Outlook Junk.

Sources

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.

↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device