Lee Meyer's sane, thoroughly reported, and well-grokked explanation of the recent CVE-2026-2441 vulnerability that was labeled a "CSS exploit" that "allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page." https://css-tricks.com/an-exploit-in-css/