Do you know of any current vulnerabilities in w3m? The last one I saw was in 2010 and fixed. Is it just not studied enough and there could be many undiscovered vulnerabilities? Beings up an interesting question of how to evaluate unknown vulnerabilities to determine if something is horribly insecure.

Not that difficult if still laborious when following the construction of IETF HTML and W3C HTML 4.x as an SGML vocabulary ab initio which already covers the vast majority of what people coming from XML have problems understanding, such as tag inference eg automatically ending span-level markup on block-level content. Plus some irregularities introduced with URLs, and with CSS and JavaScript to prevent those from being displayed as content in old browsers. Then add some more oddities introduced with WHATWG HTML 5.1+ arguably by accident and due to ignorance and lack of a formal grammar.