diff --git a/chrome/content/unsafelinks.js b/chrome/content/unsafelinks.js
index b0fd8dc74364891e63824c41314700f9de18e7ab..6ab86169c2df0db25074c5f8905d2708a2e7947f 100644
--- a/chrome/content/unsafelinks.js
+++ b/chrome/content/unsafelinks.js
@@ -16,7 +16,32 @@ var unsafelinks = {
     onMessageLoad: function(event) {
         // Replace each safelinks URL in the message body with the original URL.
         var body = event.originalTarget.body;
-        body.innerHTML = body.innerHTML.replace(unsafelinks.urlRegex, unsafelinks.replacer);
+        unsafelinks.replaceInNode(event.originalTarget.body);
+    },
+
+    replaceInNode: function(node) {
+        // Recursively replace URLs in this node and child nodes.
+        if (node.childNodes.length > 0) {
+            for (let i = 0; i < node.childNodes.length; i++) {
+                unsafelinks.replaceInNode(node.childNodes[i]);
+            }
+        }
+
+        // If this is a text node, replace URLs in the text.
+        if (node.nodeType == Node.TEXT_NODE && node.nodeValue != '') {
+            node.nodeValue = node.nodeValue.replace(unsafelinks.urlRegex, unsafelinks.replacer);
+        }
+
+        // Replace URLs in this node's attribute values.
+        // We're expecting <a href> <img src> and similar, but can't
+        // predict what other attrs may contain URLs. So check all of them.
+        if (node.attributes) {
+            for (let i = 0; i < node.attributes.length; i++) {
+                if (node.attributes[i].specified) {
+                    node.attributes[i].value = node.attributes[i].value.replace(unsafelinks.urlRegex, unsafelinks.replacer);
+                }
+            }
+        }
     },
 
     // Regular expression matching a safelinks-encoded URL.
diff --git a/manifest.json b/manifest.json
index 78b53c1cc94adf422101051f9af3914a5b61e8f9..1e2b72fc45b6cd3168ffb3e845e9ea5df4298b2a 100644
--- a/manifest.json
+++ b/manifest.json
@@ -2,7 +2,7 @@
     "manifest_version": 2,
     "name": "Un-Safelinks",
     "description": "Replace URLs which have been rewritten by Office 365 Advanced Threat Protection with the original URL.",
-    "version": "1.3.1",
+    "version": "1.3.3",
     "author": "Anton Sarukhanov",
     "homepage_url": "https://github.com/antsar/unsafelinks",
     "applications": {