[hombre_fatal]

I guess the main case is if user-generated content has an escape bug that lets the user inject a <style> tag?

[throwaway290]

If only this was about UGC. Most of it can have nothing to do with actual users. Think stuff like ads or other injects like a dependency of dependency of dependency of your frontend app compromised by a north korean hacker.