description: When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox < 74.
problem types: @import statements in CSS could bypass the Content Security Policy nonce feature
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 74, status: affected, version: unspecified, versionType: custom
}