@@ -8,6 +8,16 @@
 
     <body>
         <release version="5.8.0" date="xxxx xx, 2026" description="Chrome/Edge 157, Bugfixes">
+            <action type="add" dev="rbri">
+                HTMLObjectElement.data implemented.
+            </action>
+            <action type="fix" dev="rbri">
+                document.open() removes all event listeners and handlers of the document, its nodes and the window.
+            </action>
+            <action type="fix" dev="rbri">
+                Content-Security-Policy: the error event is fired at a link if an @import of the stylesheet is blocked;
+                when simulating Firefox, the error event is fired at blocked object elements.
+            </action>
             <action type="add" dev="rbri">
                 Content-Security-Policy: the nonce property of html and svg elements is supported; like the browsers,
                 the nonce attribute is hidden if the page has a policy delivered by a header and elements
 
@@ -52,6 +52,10 @@ public enum BrowserVersionFeatures {
     @BrowserFeature({FF, FF_ESR})
     CSP_NONCE_HIDING_ENFORCED_ONLY,
 
+    /** The error event is fired at an object element if the data url is blocked by the object-src directive. */
+    @BrowserFeature({FF, FF_ESR})
+    CSP_OBJECT_BLOCKED_FIRES_ERROR,
+
     /**
      * The Content-Security-Policy violation report (report-uri) uses the Firefox format:
      * the keys are sorted, the report uris of the original policy are absolute, the script-sample
 
@@ -161,6 +161,9 @@ public class CssStyleSheet implements Serializable {
     /** The CSS import rules and their corresponding stylesheets. */
     private final Map<CSSImportRuleImpl, CssStyleSheet> imports_ = new HashMap<>();
 
+    /** True if this (imported) style sheet was not loaded because of the Content-Security-Policy. */
+    private boolean blockedByContentSecurityPolicy_;
+
     /** cache parsed media strings. */
     private static final Map<String, MediaListImpl> MEDIA = Collections.synchronizedMap(new HashMap<>(100));
 
@@ -1270,6 +1273,7 @@ public CssStyleSheet getImportedStyleSheet(final CSSImportRuleImpl importRule) {
             if (owner_ != null && owner_.getPage() instanceof HtmlPage htmlPage
                     && !ContentSecurityPolicy.allowsExternalStyle(htmlPage, null, UrlUtils.toUrlSafe(url))) {
                 sheet = new CssStyleSheet(owner_, "", url);
+                sheet.blockedByContentSecurityPolicy_ = true;
             }
             else {
                 sheet = loadStylesheet(owner_, null, url);
@@ -1279,6 +1283,32 @@ public CssStyleSheet getImportedStyleSheet(final CSSImportRuleImpl importRule) {
         return sheet;
     }
 
+    /**
+     * Loads all imported style sheets (including nested imports) like the browsers do before
+     * the load event of the link element is fired.
+     *
+     * @return {@code false} if at least one import was blocked by the Content-Security-Policy
+     */
+    public boolean loadImports() {
+        return loadImports(new HashSet<>());
+    }
+
+    private boolean loadImports(final Set<String> alreadyProcessing) {
+        boolean allowed = true;
+        for (final AbstractCSSRuleImpl rule : wrapped_.getCssRules().getRules()) {
+            if (rule instanceof CSSImportRuleImpl importRule) {
+                final CssStyleSheet sheet = getImportedStyleSheet(importRule);
+                if (sheet.blockedByContentSecurityPolicy_) {
+                    allowed = false;
+                }
+                else if (alreadyProcessing.add(sheet.getUri()) && !sheet.loadImports(alreadyProcessing)) {
+                    allowed = false;
+                }
+            }
+        }
+        return allowed;
+    }
+
     /**
      * Returns {@code true} if this stylesheet is active, based on the media types it is associated with (if any).
      * @return {@code true} if this stylesheet is active, based on the media types it is associated with (if any)
 
@@ -873,6 +873,17 @@ public DomNode cloneNode(final boolean deep) {
         return newnode;
     }
 
+    /**
+     * <span style="color:red">INTERNAL API - SUBJECT TO CHANGE AT ANY TIME - USE AT YOUR OWN RISK.</span><br>
+     * Returns the JavaScript object that corresponds to this node if already created; in contrast to
+     * {@link #getScriptableObject()} no new object is created.
+     *
+     * @return the JavaScript object or {@code null}
+     */
+    public HtmlUnitScriptable getScriptableObjectIfCreated() {
+        return scriptObject_;
+    }
+
     /**
      * <span style="color:red">INTERNAL API - SUBJECT TO CHANGE AT ANY TIME - USE AT YOUR OWN RISK.</span><br>
      *
 
@@ -384,8 +384,17 @@ public CssStyleSheet getSheet() {
 
             // fire the load/error event after the stylesheet is stored; otherwise
             // an event handler accessing the styles would load the stylesheet again
-            final String event = pendingStylesheetEvent_;
+            String event = pendingStylesheetEvent_;
             pendingStylesheetEvent_ = null;
+
+            // like the browsers, the error event is fired if an @import is blocked by the
+            // Content-Security-Policy (the imports are loaded before the load event)
+            if (Event.TYPE_LOAD.equals(event) && sheet_ != null
+                    && getPage() instanceof HtmlPage htmlPage && htmlPage.getContentSecurityPolicy() != null
+                    && !sheet_.loadImports()) {
+                event = Event.TYPE_ERROR;
+            }
+
             if (event != null) {
                 executeEvent(getPage().getWebClient(), event);
             }
 
@@ -14,11 +14,16 @@
  */
 package org.htmlunit.html;
 
+import static org.htmlunit.BrowserVersionFeatures.CSP_OBJECT_BLOCKED_FIRES_ERROR;
+
 import java.util.Map;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.htmlunit.SgmlPage;
+import org.htmlunit.WebClient;
+import org.htmlunit.javascript.PostponedAction;
+import org.htmlunit.javascript.host.event.Event;
 import org.htmlunit.javascript.host.html.HTMLObjectElement;
 import org.htmlunit.util.StringUtils;
 import org.htmlunit.xml.XmlPage;
@@ -265,7 +270,7 @@ public final String getVspaceAttribute() {
     @Override
     protected void onAddedToPage() {
         super.onAddedToPage();
-        ContentSecurityPolicy.allowsObject(this, getAttributeDirect("data"));
+        checkContentSecurityPolicy(getAttributeDirect("data"));
     }
 
     /**
@@ -283,7 +288,40 @@ protected void setAttributeNS(final String namespaceURI, final String qualifiedN
                 notifyAttributeChangeListeners, notifyMutationObservers);
 
         if (changed && isAttachedToPage()) {
-            ContentSecurityPolicy.allowsObject(this, value);
+            checkContentSecurityPolicy(value);
+        }
+    }
+
+    /**
+     * Checks the url against the Content-Security-Policy (object-src); if the url is blocked,
+     * Firefox fires the error event (async).
+     */
+    private void checkContentSecurityPolicy(final String data) {
+        if (ContentSecurityPolicy.allowsObject(this, data)) {
+            return;
+        }
+
+        final HtmlPage htmlPage = getHtmlPageOrNull();
+        if (htmlPage == null || !hasFeature(CSP_OBJECT_BLOCKED_FIRES_ERROR)) {
+            return;
+        }
+
+        final WebClient client = htmlPage.getWebClient();
+        if (!client.isJavaScriptEngineEnabled()) {
+            return;
+        }
+
+        final PostponedAction action = new PostponedAction(htmlPage, "HtmlObject.blocked") {
+            @Override
+            public void execute() {
+                HtmlObject.this.fireEvent(Event.TYPE_ERROR);
+            }
+        };
+        if (READY_STATE_LOADING.equals(htmlPage.getReadyState())) {
+            htmlPage.addAfterLoadAction(action);
+        }
+        else {
+            client.getJavaScriptEngine().addPostponedAction(action);
         }
     }
 
 
@@ -82,6 +82,15 @@ public final EventListenersContainer getEventListenersContainer() {
         return eventListenersContainer_;
     }
 
+    /**
+     * <span style="color:red">INTERNAL API - SUBJECT TO CHANGE AT ANY TIME - USE AT YOUR OWN RISK.</span><br>
+     * Removes all event listeners and event handlers of this event target
+     * (e.g. done by document.open()).
+     */
+    public void removeAllEventListeners() {
+        eventListenersContainer_ = null;
+    }
+
     /**
      * Executes the event on this object only (needed for instance for {@code onload} on {@code (i)frame} tags).
      *
 
@@ -63,6 +63,7 @@
 import org.htmlunit.javascript.host.dom.NodeList;
 import org.htmlunit.javascript.host.dom.Selection;
 import org.htmlunit.javascript.host.event.Event;
+import org.htmlunit.javascript.host.event.EventTarget;
 import org.htmlunit.util.UrlUtils;
 
 /**
@@ -470,6 +471,17 @@ public HTMLDocument open(final Object url, final Object name, final Object featu
             LOG.warn("Function open() called when document is already open.");
         }
         writeInCurrentDocument_ = false;
+
+        // like the browsers, document.open() removes all event listeners and handlers
+        // of the document, all its nodes and the window
+        for (final DomNode node : page.getDescendants()) {
+            if (node.getScriptableObjectIfCreated() instanceof EventTarget target) {
+                target.removeAllEventListeners();
+            }
+        }
+        removeAllEventListeners();
+        getWindow().removeAllEventListeners();
+
         final WebWindow ww = getWindow().getWebWindow();
         if (ww instanceof FrameWindow window
                 && UrlUtils.ABOUT_BLANK.equals(getPage().getUrl().toExternalForm())) {
 
@@ -14,9 +14,12 @@
  */
 package org.htmlunit.javascript.host.html;
 
+import java.net.MalformedURLException;
+
 import org.htmlunit.html.DomElement;
 import org.htmlunit.html.HtmlForm;
 import org.htmlunit.html.HtmlObject;
+import org.htmlunit.html.HtmlPage;
 import org.htmlunit.javascript.configuration.JsxClass;
 import org.htmlunit.javascript.configuration.JsxConstructor;
 import org.htmlunit.javascript.configuration.JsxFunction;
@@ -44,6 +47,39 @@ public void jsConstructor() {
         super.jsConstructor();
     }
 
+    /**
+     * Returns the {@code data} property; the url of the data attribute resolved against the
+     * base url of the page (an empty attribute is resolved to the base url, a missing attribute
+     * returns an empty string).
+     * @return the {@code data} property
+     */
+    @JsxGetter
+    public String getData() {
+        final DomElement element = getDomNodeOrDie();
+        final String data = element.getAttributeDirect("data");
+        if (DomElement.ATTRIBUTE_NOT_DEFINED == data) {
+            return "";
+        }
+        if (element.getPage() instanceof HtmlPage page) {
+            try {
+                return page.getFullyQualifiedUrl(data).toExternalForm();
+            }
+            catch (final MalformedURLException e) {
+                return data;
+            }
+        }
+        return data;
+    }
+
+    /**
+     * Sets the {@code data} attribute.
+     * @param data the {@code data} attribute value
+     */
+    @JsxSetter
+    public void setData(final String data) {
+        getDomNodeOrDie().setAttribute("data", data);
+    }
+
     /**
      * Gets the {@code border} attribute.
      * @return the {@code border} attribute
 
@@ -98,7 +98,8 @@
                     <td>
                         inline <code>&lt;style&gt;</code> elements (parser inserted and created by JavaScript),
                         stylesheets loaded by <code>&lt;link rel="stylesheet"&gt;</code> (the <code>error</code>
-                        event is fired for blocked stylesheets) and <code>@import</code> rules; blocked
+                        event is fired for blocked stylesheets) and <code>@import</code> rules (the
+                        <code>error</code> event is fired at the link if an import is blocked); blocked
                         styles are not applied
                     </td>
                 </tr>
@@ -148,7 +149,8 @@
                         <code>&lt;embed&gt;</code> elements (also if added by script or if the attribute is
                         changed later). HtmlUnit does not load the content of these elements; the url is
                         checked anyway to report the violation (cross origin urls are reported as origin).
-                        There are no <code>load</code> and <code>error</code> events.
+                        There is no <code>load</code> event; when simulating Firefox the <code>error</code>
+                        event is fired at blocked <code>&lt;object&gt;</code> elements.
                     </td>
                 </tr>
                 <tr>