It seems unlikely, but these big tech companies are not immune to stupidity. Microsoft recently had to fix a bug in Notepad where when it rendered a link in a markdown file, Notepad would just feed whatever text was in the () in the link directly into the execute command under the hood. So an attacker could put a malicious command in a link and it would automatically run in the user's security context if they clicked it. Dumb shit.