What's blocked

In CSS values

Inline style="..." rejects the entire declaration if it contains any of these. <style> blocks scrub the scripting vectors but (unlike inline styles) allow url(...).

Pattern	What it blocks
expression\s*\(	CSS expression() (legacy IE scripting)
javascript\s*:	javascript: URLs
vbscript\s*:	vbscript: URLs
-moz-binding	-moz-binding (XBL scripting)
behavior\s*:	behavior: (IE behaviors)
url\s*\(	url(...) — in inline style= only; allowed in <style> blocks for same-origin resources

In <style> blocks — at-rules

• Scoped & kept: @container · @layer · @media · @supports — recursed into and prefixed with .hw-parser-output.
• Kept verbatim: -webkit-keyframes · keyframes · page — emitted unscoped.
• Dropped: @import, @font-face, @charset, @namespace, and any other at-rule.