Let's say users can define content of the
style attribute, but in a constrained way. They can't break out of its value, as white-listing parser will remove any unsafe attributes/tags produced this way.
Can they do XSS using just the
style attribute value in modern browsers?
With 'modern' being IE10+ and newest versions of other browsers.