This is a common sight in content security policies:
style-src 'unsafe-inline'
I know that this "UI redressing attacks" that can be use for phishing or just defamation. But are there other threats as well? In particular, I am interested in:
- Script execution
- Data exfiltration
Can a liberal CSP for styles lead to any of those? If so, how?