2 ms·

Wait WTF, `javascript:` URLs are acceptable in the CSS `url` property?? From the SO post: > url('javascript: eval(evil)');