Revision ea429729-9edd-42d6-ac87-9beafad5cc6f - Information Security Stack Exchange

I have searched for it everywhere, but I think all modern browsers are safe from XSS into CSS.
Although I had one particular test and it got executed into my Chrome (and probably other browsers)

If you application is *naively* injecting any input into `<style>...</style>` this interesting scenario can happen:

    <html>
    <head>
    <style>
    p {
        text-align: center;
        color: red;
        /*user can inject here*/
        }</style><script>alert()</script>
    
    }
    </style>
    </head>
    <body>
    
    <h1>My First Heading</h1>
    
    <p>My first paragraph.</p>
    
    </body>
    </html>

...

OR

    p {
        /*injecting into bg's url*/
        background: url("garbage"}</style><script>alert()</script>/*) repeat;
        text-align: center;
        color: red;
    } 

Obviously .. an `XSS`

![enter image description here][1]


  [1]: https://i.sstatic.net/1CmCj.png