Hi skavans,
if you can insert ", then you may want to try to add " rel="import" href="https://someurljusttotest/ and see if the browser (it just works on Chrome) makes a request to someurljusttotest.
Hi,
It has been a while since the topic have started but I wonder whether you succes to exploit or not. I couldn’t use the technique that @stefanofindsbugs tells. having 2 rel in a tag doesn’t help because browser just care about first one, second one is ignored (at least in latest chrome 63.0.3239 version )