CSP bypass via duplicate element nonce exposure

Markup injection in Mozilla Firefox before 124, Firefox ESR before 115.9, and Thunderbird before 115.9 allows remote attackers to steal CSP nonces. The HTML parser copies nonce attributes from duplicate or dangling html and body tags onto connected parent elements without applying nonce hiding, exposing the values to CSS selectors. Exploitation requires attacker-controlled markup before a nonce-bearing script and user interaction with the rendered content; the leaked nonce enables script injection that the site's strict CSP was intended to block.