---
id: 5470
title: "Bypassing CSP with dangling iframes"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/bypassing-csp-with-dangling-iframes"
published_at: "2022-06-14T14:00:00Z"
tags: ["web-security", "chrome", "iframes", "csp-bypass", "dangling-markup", "window-name"]
phying_url: "https://phying.com/item/5470"
lang: en
---

# Bypassing CSP with dangling iframes

## Summary

A CSP bypass found when Chrome 97 broke a dangling-markup lab: setting a cross-domain iframe to about:blank hands ownership to the attacker, exposing window.name and running script despite CSP.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-06-14T14:00:00Z
- **Original:** https://portswigger.net/research/bypassing-csp-with-dangling-iframes
- **Phying News:** https://phying.com/item/5470