XSS bug in Yahoo Mail could have let attackers take over email accounts

Javascript is disabled in your web browser. Please enable it (see how).

January 21, 2016 By aatech

To have an account taken over, a victim would have only needed to open a boobytrapped email.
Source: Sophos