diff --git a/www/bounce/main.js b/www/bounce/main.js
index edb4f029c..ddb23d983 100644
--- a/www/bounce/main.js
+++ b/www/bounce/main.js
@@ -9,6 +9,12 @@ define(['/api/config'], function (ApiConfig) {
         window.alert('The bounce application must only be used with a valid href to visit');
         return;
     }
+    if (bounceTo.indexOf('javascript:') === 0 || // jshint ignore:line
+        bounceTo.indexOf('vbscript:') === 0 || // jshint ignore:line
+        bounceTo.indexOf('data:') === 0) {
+        window.alert('Illegal bounce URL');
+        return;
+    }
     window.opener = null;
     window.location.href = bounceTo;
 });
diff --git a/www/common/diffMarked.js b/www/common/diffMarked.js
index fb59f6262..467dfa3e6 100644
--- a/www/common/diffMarked.js
+++ b/www/common/diffMarked.js
@@ -28,12 +28,17 @@ define([
     };
 
     Marked.setOptions({
+        //sanitize: true, // Disable HTML
         renderer: renderer,
         highlight: highlighter(),
     });
 
-    DiffMd.render = function (md) {
-        return Marked(md);
+
+
+    DiffMd.render = function (md, sanitize) {
+        return Marked(md, {
+            sanitize: sanitize
+        });
     };
 
     var mediaMap = {};
@@ -101,8 +106,9 @@ define([
         'IFRAME',
         'OBJECT',
         'APPLET',
-        //'VIDEO', // privacy implications of videos are the same as images
-        //'AUDIO', // same with audio
+        'VIDEO', // privacy implications of videos are the same as images
+        'AUDIO', // same with audio
+        'SVG'
     ];
     var unsafeTag = function (info) {
         /*if (info.node && $(info.node).parents('media-tag').length) {
@@ -117,10 +123,10 @@ define([
         }
         if (['addElement', 'replaceElement'].indexOf(info.diff.action) !== -1) {
             var msg = "Rejecting forbidden tag of type (%s)";
-            if (info.diff.element && forbiddenTags.indexOf(info.diff.element.nodeName) !== -1) {
+            if (info.diff.element && forbiddenTags.indexOf(info.diff.element.nodeName.toUpperCase()) !== -1) {
                 console.log(msg, info.diff.element.nodeName);
                 return true;
-            } else if (info.diff.newValue && forbiddenTags.indexOf(info.diff.newValue.nodeName) !== -1) {
+            } else if (info.diff.newValue && forbiddenTags.indexOf(info.diff.newValue.nodeName.toUpperCase()) !== -1) {
                 console.log("Replacing restricted element type (%s) with PRE", info.diff.newValue.nodeName);
                 info.diff.newValue.nodeName = 'PRE';
             }
@@ -142,7 +148,7 @@ define([
 
     var removeForbiddenTags = function (root) {
         if (!root) { return; }
-        if (forbiddenTags.indexOf(root.nodeName) !== -1) { removeNode(root); }
+        if (forbiddenTags.indexOf(root.nodeName.toUpperCase()) !== -1) { removeNode(root); }
         slice(root.children).forEach(removeForbiddenTags);
     };
 
diff --git a/www/contacts/messenger-ui.js b/www/contacts/messenger-ui.js
index 7afbf9df9..d73ce5604 100644
--- a/www/contacts/messenger-ui.js
+++ b/www/contacts/messenger-ui.js
@@ -4,9 +4,8 @@ define([
     '/common/common-util.js',
     '/common/common-interface.js',
     '/common/hyperscript.js',
-    '/bower_components/marked/marked.min.js',
-    '/common/media-tag.js',
-], function ($, Messages, Util, UI, h, Marked, MediaTag) {
+    '/common/diffMarked.js',
+], function ($, Messages, Util, UI, h, DiffMd) {
     'use strict';
 
     var debug = console.log;
@@ -138,12 +137,14 @@ define([
         $(window).on('resize', onResize);
 
         var m = function (md, hour) {
-            var d = h('div.cp-app-contacts-content');
+            var id = Util.createRandomInteger();
+            var d = h('div', {
+                id: 'msg-'+id
+            });
             try {
-                d.innerHTML = Marked(md || '');
                 var $d = $(d);
-                // remove potentially malicious elements
-                $d.find('script, iframe, object, applet, video, audio').remove();
+                DiffMd.apply(DiffMd.render(md || '', true), $d, common);
+                $d.addClass("cp-app-contacts-content");
 
                 // override link clicking, because we're in an iframe
                 $d.find('a').each(function () {
@@ -153,9 +154,6 @@ define([
                     }).attr('href');
                 });
 
-                // activate media-tags
-                $d.find('media-tag').each(function (i, e) { MediaTag(e); });
-
                 var time = h('div.cp-app-contacts-time', hour);
                 $d.append(time);
             } catch (e) {