Preliminary research
Incorrect tokenization of bad URLs enables CSS sanitizer bypass
AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.
A tokenizer mistakes a previously consumed escaped backslash for an escape of the next closing parenthesis. The sanitizer consumes CSS that the browser treats as live declarations or rules.
Record
- Published by
- Crass project
- Date
- Format
- Advisory
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Crass project, first published at the original source. Preserved copies are kept so the citation survives its host.