Vulnerability Spotlight: Content Security Policy bypass in Microsoft Edge, Google Chrome and Apple Safari
Summary: Cisco Talos disclosed Content Security Policy bypass vulnerabilities in Microsoft Edge, older Google Chrome (CVE-2017-5033) and WebKit-based browsers including Apple Safari (CVE-2017-2419), found by Nicolai Grødum of Cisco. Exploitation uses the "unsafe-inline" directive, window.open() to create a blank window, and document.write to inject code that bypasses CSP restrictions; Microsoft declined to patch, calling it by design, while Chrome was fixed in 57.0.2987.98 and Safari in 10.1 (iOS 10.3).
What you should know: Developers rely on CSP to stop XSS and the data leaks and session hijacking that follow, but browser-specific implementation gaps let attackers write code that slips past the policy - and Microsoft has said it will not fix Edge.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-2419CVE-2017-5033
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026