This collection is all the vectors I used for my research CSS:the bomb inside your inbox. You can read about the research when released here: portswigger.net/research/css-the-bomb-inside-your-…
<style>0x0D
.x{color:red;}⟦0D⟧
</style>0x0D
<div id=x class="x$[chr]y">test</div>0x0D
<div id=x style="background:$[chr]url(/foo)">test</div>0x0D
<style>0x0D
.x{⟦0D⟧
font-family:"foo, bar, baz$[chr]}.x{color:red;⟦0D⟧
}⟦0D⟧
</style>0x0D
<div id=x class="x">test</div>0x0D
<div id=x style="--&#$[i]:red;color:var(--&#$[i])">test</div>0x0D
<div id=x style="color:red!&#$[i];\69mportant">test</div>0x0D
<style>0x0D
$[chr]{position:"⟦0D⟧
}@import'data:text/css,%23x{color:red}';⟦0D⟧
</style>0x0D
<div id="x">test</div><style>0x0D
x$[chr]{position:"⟦0D⟧
}@import'data:text/css,%23x{color:red}';⟦0D⟧
</style>0x0D
<div id="x">test</div>const style = document.createElement("style");0x0D
style.textContent = String.fromCodePoint($[i])+'@import url("https://fuzz.shazzer.co.uk/$[rand]?$[i]");';0x0D
document.head.appendChild(style);const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint($[i])+'url("https://fuzz.shazzer.co.uk/$[rand]?$[i]");';0x0D
document.head.appendChild(style);<svg><$[data1] $[data2]="https://fuzz.shazzer.co.uk/$[rand]?$[data1]->$[data2]" /><div id=x style="$[chr]color:red">test</div>0x0D
<div style=$[data1]:url(https://fuzz.shazzer.co.uk/$[rand]?$[data1])></div><div style="$[data1]:$[data2]('https://fuzz.shazzer.co.uk/$[rand]?$[data1]->$[data2]')"></div><div style=background:$[chr]image-set(url(https://fuzz.shazzer.co.uk/$[rand]?$[i]#))>const style = document.createElement("style");0x0D
style.textContent = '@x'+String.fromCodePoint($[i])+'@import url(https://fuzz.shazzer.co.uk/$[rand]?$[i]);';0x0D
document.head.appendChild(style);const style = document.createElement("style");0x0D
style.textContent = '@x{}'+String.fromCodePoint($[i])+'@import url(https://fuzz.shazzer.co.uk/$[rand]?$[i]);';0x0D
document.head.appendChild(style);<div style="background:url(\$[hex2]/fuzz.shazzer.co.uk/$[rand]?$[hex2])"><div style="background:url(/\$[hex2]/fuzz.shazzer.co.uk/$[rand]?$[hex2])"><div style="background:url('/\$[chr]/fuzz.shazzer.co.uk/$[rand]?$[i]')">