diff --git a/src/app/mail/[id]/page.tsx b/src/app/mail/[id]/page.tsx
index de72729..f031830 100644
--- a/src/app/mail/[id]/page.tsx
+++ b/src/app/mail/[id]/page.tsx
@@ -81,7 +81,11 @@ function triggerDownload(blob: Blob, filename: string) {
 // pixel") to the sender. Covers src=, srcset=, background=, <link href=> and
 // CSS url() in <style> blocks / style= attributes. data:- and cid:-URIs stay
 // untouched so inline/archived content keeps rendering.
-const EXTERNAL_URL_RE = /^\s*(?:https?:)?\/\//i;
+// Matches http(s): schemes and protocol-relative URLs. WHATWG's URL parser
+// treats backslashes as authority slashes for special schemes too, so
+// "https:/\/evil.com" and "https:\\evil.com" resolve exactly like
+// "https://evil.com" in a real browser and must be caught as well.
+const EXTERNAL_URL_RE = /^\s*(?:https?\s*:|[/\\]\s*[/\\])/i;
 
 // Tags whose src= attribute triggers a network request.
 const SRC_TAGS = new Set(["img", "video", "audio", "source"]);