In the pull request #592, the openExternalLinks is set to true for the QTextBrowser. This opens a wide range of security concerns. E.g., you could send something like: <a href="http://fraudulentsite.com">https://www.google.com/search?q=lyrics+sunshine+of+my+love</a> (see 18b1fca#r42649147).
We already discussed some security concerns in #360 and, e.g., #380 (comment) and #360 (comment).