Bypassing CSP with policy injection
Summary: While testing PayPal for CSP and mixed-content bypasses, researcher Gareth Heyes found that a GET parameter called token was placed inside the report-uri directive of PayPal's CSP, allowing directives to be injected into the policy by changing that parameter. Edge drops the entire policy on invalid syntax, which a semi-colon and underscore in the token triggered, while Chrome ignores invalid directives but can be overridden with the script-src-elem directive, and PayPal awarded $900 for the bug.
Key Takeaway: A single reflected parameter inside a CSP header was enough to strip Edge's protection entirely and to override Chrome's script-src via script-src-elem, so any policy built from user input is only as strong as the browser's error handling.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026