Comment by bandamo

Stumbled upon this and seems like a security issue. Why do browser not block the access to the nonce attribute?