I think there's been one or two image decompression exploits over the years, so a site with a malicious file could end up running code on your system. I remember this being an issue with Minecraft clients and player skins at one point, but I can't remember any specific times this happened in browsers tho.

I build custom websites that run primarily on css and html. Light JS for applications, and some simple PHP to tie everything together. I am unaware of any flaw or exploit that would disable my sites. I don't recall any html vulnerabilities. Unless there's e-commerce involved, that's nothing I can think of that would be exploitable on either side for html or css. These are both hard coded into the browser so I'm not even sure what an exploit would accomplish other than changing values on the client side. But it's been a long week...

Edit Looks like zarobi below remembered some exploits. Totally forgot about iframes and the weird image data exploits.

Yeah but if it's just pure HTML you got an ugly-ass website that's annoying to use. There's been many JavaScript and css vulnerabilities over the years of course. But yes there was and still is plain HTML issues

Client side:

• I vaguely remember some base64 embedded encoding malware.
• I do believe there was some issues with early HTML, if you had malformed tags, that could bypass checks and balances.
• Svg, Images, audio, fonts, and video can definitely contain malware. Before you say fonts are a css thing, was a real tag
• IFrames were the worst:
  • They had too much power in the past and could hijack the page and browser.
  • There was no content security policy back then so they could inject JavaScript into the main page as well.
  • Also they can cover the whole screen and present a normal login screen, and hijack all inputs going through it. Think of it like you're on dodgey-site.com and it has a full page IFrame to bank.com. This was a common hack back in the day which inspired an entire http header to help prevent this.
• Anchor tags can link to something dodgey of course.
• Embedded PDFs were a huge issue.
• ActiveX and other web applets was just fucked. They were so bad they caused malware constantly. This is where unsolicited toolbars came from.
• Adobe Flash had many many vulnerabilities over the years.
• Canvas bugs are still a thing today.

Server side, you could execute SQL injection and path traversal just via URL before the page even loads. Malware and other issues can be embedded in text inputs. HTML can be uploaded to the server and in some cases replayed on the page affecting other users (comment sections were infamous for this).

So yeah; a plain HTML page with no JavaScript or css isn't necessarily safe

My man