Kojima Hajime reported that unlike literal null
characters which were handled correctly, the escaped form '\0'
was ignored by the CSS parser and treated as if it was not present in
the CSS input string. This issue could potentially be used to bypass
script sanitization routines in web applications. The severity of
this issue was determined to be low.
Vulmon