CSS the bomb inside your inbox

<style>
.x{color:red;}
</style>
<div id=x class="x$[chr]y">test</div>

<div id=x style="background:$[chr]url(/foo)">test</div>

<style>
.x{
   font-family:"foo, bar, baz$[chr]}.x{color:red;
}
</style>
<div id=x class="x">test</div>

<div id=x style="--&#$[i]:red;color:var(--&#$[i])">test</div>

<div id=x style="color:red!&#$[i];\69mportant">test</div>

<style>
$[chr]{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>

<style>
x$[chr]{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>

const style = document.createElement("style");
style.textContent = String.fromCodePoint($[i])+'@import url("https://fuzz.shazzer.co.uk/$[rand]?$[i]");';
document.head.appendChild(style);

const style = document.createElement("style");
style.textContent = '@import'+String.fromCodePoint($[i])+'url("https://fuzz.shazzer.co.uk/$[rand]?$[i]");';
document.head.appendChild(style);

<svg><$[data1] $[data2]="https://fuzz.shazzer.co.uk/$[rand]?$[data1]->$[data2]" />

<div id=x style="$[chr]color:red">test</div>

<div style=$[data1]:url(https://fuzz.shazzer.co.uk/$[rand]?$[data1])></div>

<div style="$[data1]:$[data2]('https://fuzz.shazzer.co.uk/$[rand]?$[data1]->$[data2]')"></div>

<div style=background:$[chr]image-set(url(https://fuzz.shazzer.co.uk/$[rand]?$[i]#))>

const style = document.createElement("style");
style.textContent = '@x'+String.fromCodePoint($[i])+'@import url(https://fuzz.shazzer.co.uk/$[rand]?$[i]);';
document.head.appendChild(style);

const style = document.createElement("style");
style.textContent = '@x{}'+String.fromCodePoint($[i])+'@import url(https://fuzz.shazzer.co.uk/$[rand]?$[i]);';
document.head.appendChild(style);

<div style="background:url(\$[hex2]/fuzz.shazzer.co.uk/$[rand]?$[hex2])">

<div style="background:url(/\$[hex2]/fuzz.shazzer.co.uk/$[rand]?$[hex2])">

<div style="background:url('/\$[chr]/fuzz.shazzer.co.uk/$[rand]?$[i]')">