The vulnerability stemmed from improper handling of <style> tag content within <option> elements. The writeCloseTag method in HtmlStreamRenderer.java was modified to add validation checks for dangerous CDATA sequences, indicating it was the primary vulnerable function. The pre-patch version directly appended user-controlled CDATA content without sanitization, making it the exploitation point for policy bypass attacks.