Comment by hoophoop

Epub can do all sort of homecalling / user tracking using HTML or CSS or javascript.

What's even worse - almost all Epub readers don't do proper sandboxing.