This question already has an answer here:
- Style attribute XSS without quotes 1 answer
This is a common sight in content security policies:
I know that this "UI redressing attacks" that can be use for phishing or just defamation. But are there other threats as well? In particular, I am interested in:
- Script execution
- Data exfiltration
Can a liberal CSP for styles lead to any of those? If so, how?