AngularJS CSP bypass in 56 characters
Summary: PortSwigger researcher Gareth Heyes presented an AngularJS CSP bypass in 63 characters at his Allstars talk, then challenged others to shorten it; Erlend Oftedal cut it by replacing the CSS property with "x", the ID of the injected input element, which works as a global property of window. Heyes later reduced the payload further by using an assignment to evade AngularJS's window object detection, and notes that since Chrome 109 the path property has been removed, with composedPath() as the workaround.
What you should know: The technique relies on AngularJS filters executing expressions and on the Chrome path property exposing the window object as its last element - and the removal of path in Chrome 109 shows how a single browser change can retire a working bypass, so payloads your scanner flags today may not be the ones that matter tomorrow.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026