---
id: 5510
title: "Bypassing CSP with policy injection"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/bypassing-csp-with-policy-injection"
published_at: "2020-09-04T14:31:00Z"
tags: ["bug-bounty", "portswigger", "chrome", "csp-bypass", "paypal", "edge", "policy-injection"]
phying_url: "https://phying.com/item/5510"
lang: en
---

# Bypassing CSP with policy injection

## Summary

Gareth Heyes injects directives into PayPal's CSP via a token parameter in report-uri, dropping Edge's whole policy with a stray semicolon and overriding Chrome's script-src for a $900 bounty.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2020-09-04T14:31:00Z
- **Original:** https://portswigger.net/research/bypassing-csp-with-policy-injection
- **Phying News:** https://phying.com/item/5510