card css escape battery

index.html

@@ -1,22 +1,9 @@
 <!doctype html><html><body>
 <div class="card">
-<h1>BAT2</h1>
-<base href="https://evil.example/">
-<meta http-equiv="refresh" content="0;url=https://evil.example/r">
-<link rel="stylesheet" href="https://evil.example/x.css">
-<form action="https://evil.example/f" method="post"><input name="a" value="b"><button>go</button></form>
-<object data="https://evil.example/o"></object>
-<embed src="https://evil.example/e">
-<template><img src=x onerror="window.__tpl=1"></template>
-<video poster="x" onerror="window.__vid=1"></video>
-<input autofocus onfocus="window.__foc=1">
-<select autofocus onfocus="window.__sel=1"><option>1</option></select>
-<textarea autofocus onfocus="window.__ta=1"></textarea>
-<svg><a xlink:href="javascript:window.__xlink=1"><text>t</text></a></svg>
-<svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg'><image href='1' onerror='window.__use=1'/></svg>#x"/></svg>
-<math><annotation-xml encoding="text/html"><img src=x onerror="window.__ann=1"></annotation-xml></math>
-<noscript><p title="</noscript><img src=x onerror=window.__nos=1>"></noscript>
-<style>@import url("https://evil.example/imp.css"); .x{background:url(https://evil.example/bg)}</style>
-<textarea title="</textarea><img src=x onerror=window.__txt=1>">z</textarea>
+<h1>CSSESC</h1>
+<style>p{content:"\3c /style\3e\3c img src=x onerror=window.__css1=1\3e"}</style>
+<style>p{content:'\3C\2Fstyle\3E\3Cscript\3Ewindow.__css2=1\3C\2Fscript\3E'}</style>
+<style>p{content:"\00003c /style\00003e\00003c img src=x onerror=window.__css3=1\00003e"}</style>
+<style>@media all{ p{ color:red } } /* \3c/style\3e */</style>
 </div>
 </body></html>