--- title: "Mbox Viewer 2.9.0: Safer, Faster and More Accessible" description: "A release built from a review of 2.8.6 on four fronts: security, performance, usability and accessibility. Plus Malay, Finnish and Hebrew, for 21 languages. On the Mac App Store and the Microsoft Store since 25 September." url: https://mboxviewerpro.com/blog/whats-new-in-mbox-viewer-2-9-0/ language: en updated: 2026-09-25 source: Mbox Viewer --- [All posts](https://mboxviewerpro.com/blog/) `announcement` `product` `macos` `windows` # Mbox Viewer 2.9.0: Safer, Faster and Easier to Use With a Screen Reader A release built from a review of 2.8.6 on four fronts: security, performance, usability and accessibility. Plus Malay, Finnish and Hebrew, for 21 languages. On the Mac App Store and the Microsoft Store since 25 September. [David Carrero](https://mboxviewerpro.com/author/) · September 25, 2026 **2.9.0** is out on the **Mac App Store** and the **Microsoft Store** as of 25 September. This one has no headline feature. It comes from reviewing 2.8.6 on four fronts at once — security, performance, usability and accessibility — first on the Mac and then again on the Windows code, which is not a copy of the other. Part of what turned up on the Mac did not exist on Windows, and Windows had problems of its own. What follows is what changes for you, on each platform. The app is still **read-only**: nothing here modifies the archive you open. ## Opening a message no longer does anything behind your back The most serious fix is on the Mac. The reader let through any address carrying a `#fragment`, and a redirect tag written with HTML entities slipped past the filter. The result: simply **viewing** a crafted message could open your browser at someone else’s address — a read receipt that gave away your IP even with remote images blocked. Now only the app’s own content loads in the reader, and links open only when you click them. Remote images can no longer be redirected into your local network either. On Windows that hole did not exist (the reader runs with JavaScript off and a different sanitiser), but the review found another one in the **exported HTML**. The `.html` and `.mht` files you hand to a lawyer or an auditor could carry the message’s scripts, tracking pixels and network paths — and a network path opened in Windows can send your session’s credentials to another machine. Exports now go out clean on both platforms: no scripts, no remote content, no network paths. And a few more that matter when an archive becomes evidence: - **CSV exports neutralise spreadsheet formulas.** A subject starting with `=` no longer runs when the file is opened in Excel or Numbers, whether the separator is a comma or a semicolon. - **Merging with duplicate removal can no longer be tricked.** A message with a copied Message-ID used to make the real one disappear from the merged file; duplicates are now matched by ID *and* content. - **Exporting and merging refuse to write over the mailbox you have open.** - On Windows, **attachments open marked as downloaded from the Internet**, so Office opens them in Protected View and SmartScreen can check them. - A **refunded purchase or an expired subscription stops unlocking Pro**, and on Windows the change shows without restarting the app. ## Quicker with large mailboxes On the Mac, closing a window left up to ~128 MB of cache in memory, every time. That leak is fixed. Reopening a large mailbox, sorting and filtering are noticeably quicker — sorting happens once per column and order, and each keystroke cancels the previous filter — and full-text search reads several messages in parallel. On Windows, moving quickly through the list could show one message’s header above another message’s body; that no longer happens. HTML messages over 2 MB, which used to stay blank, now display. ## Exports and searches that tell you what is going on - Exports show **“Exporting N of M”**, can be cancelled, and end with **Show in Finder** or **Show in Explorer**. - Errors arrive **in your language and with the cause** — disk full, no permission, file in use — instead of a vague failure or nothing at all. - In search, **Escape** stops a running search and then clears the field; the app tells you when you need to press **Return** to search inside message bodies, and says so when nothing matches. - On the Mac, **eight settings that did nothing** — default sort, date format, layout, CSV separator and others — now take effect, and the app remembers your sort order and layout. ## Better with VoiceOver, Narrator and the keyboard On both platforms, **every button now has a name** for the screen reader, and the app announces when a search, an export or a merge finishes, or when something fails. On Windows, Narrator used to read an internal class name on every row of the list; it now reads the message and the label. There is **text zoom** as well — ⌘+ and ⌘− on the Mac, Ctrl + and Ctrl − on Windows, with 0 to reset — along with better contrast and larger click targets. On the Mac the sidebar is a real list you can walk with the arrow keys and Reduce Motion is respected; on Windows, **F6** jumps between panes. ## Malay, Finnish and Hebrew The app is now available in **21 languages**. Hebrew is shown right to left, with the arrows flipped to match; headers, source and hex views stay left to right, because that is how email is written. ## Getting it 2.9.0 arrives as an ordinary update: from the Mac App Store on the Mac and from the Microsoft Store on Windows. The free tier does not change: mailboxes up to 1 GB, with every feature. The full list, platform by platform, is on the [changelog](https://mboxviewerpro.com/changelog/). ## Open your archive with Mbox Viewer Native Mac and Windows app. Streams MBOX and EML files of any size, fully offline. [Mac App Store](https://apps.apple.com/app/mbox-viewer-pro/id6759237715) [Microsoft Store](https://apps.microsoft.com/store/detail/9NW3GVFG7DDB)