Bypassing CSP using polyglot JPEGs
Summary: PortSwigger researcher Gareth Heyes built a polyglot JavaScript/JPEG file that executes as script when loaded via a script tag, using the JPEG header length bytes 0x2F2A to open a JavaScript comment and a JPEG comment segment to carry the payload. The technique bypasses CSP on sites that host user-uploaded images on the same domain and allow script from 'self', working on Safari, Firefox, Edge and IE11 but not Chrome, and requiring the ISO-8859-1 charset on the script tag in Firefox.
Bottom line: If your CSP trusts 'self' and user-uploaded JPEGs sit on the same domain as your app, an uploaded image can become executable script - which is why the researcher recommends serving uploaded assets from a separate domain, rewriting JPEG headers, stripping comments, and keeping image domains out of your script whitelist.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026