Curated security research, vulnerabilities, advisories and tools for practitioners.

#csp-bypass

Security coverage tagged csp-bypass.

1.

Roundcube XSS chained with cookie tossing for full inbox access

blog | 2026-04-21 00:00 | aikido.dev | original ↗ | #ai-security | #attack-chains | #web-security

2.

Blind CSS Exfiltration: exfiltrate unknown web pages

research | 2024-07-11 10:09 | portswigger.net | original ↗ | #web-security | #csp-bypass | #exfiltration

3.

Bypassing CSP via DOM clobbering

research | 2023-06-05 14:00 | portswigger.net | original ↗ | #burp-suite | #web-security | #xss

4.

Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO

research | 2023-04-28 12:31 | portswigger.net | original ↗ | #web-security | #dom-xss | #csp-bypass

5.

Escaping misconfigured VSCode extensions

vulnerability | 2023-02-21 13:00 | CVE-2022-41042 | blog.trailofbits.com | original ↗ | #vulnerability-research | #xss | #path-traversal

6.

AngularJS CSP bypass in 56 characters

research | 2023-01-12 08:36 | portswigger.net | original ↗ | #browser-security | #xss | #portswigger

7.

Hijacking service workers via DOM Clobbering

research | 2022-12-05 08:50 | portswigger.net | original ↗ | #web-security | #xss | #client-side-security

8.

Evading defences using VueJS script gadgets

research | 2022-09-07 09:05 | portswigger.net | original ↗ | #xss | #waf-bypass | #csp-bypass

9.

Finding DOM Polyglot XSS in PayPal the Easy Way

research | 2022-09-07 09:04 | portswigger.net | original ↗ | #bug-bounty | #dom-invader | #dom-xss

10.

Bypassing CSP with dangling iframes

research | 2022-06-14 14:00 | portswigger.net | original ↗ | #web-security | #chrome | #iframes

11.

Novel Attack Vector to Bypass CSP Via Same Origin Method Execution (Wordpress Zeroday)

blog | 2022-05-29 11:00 | pwn.ai | original ↗ | #vulnerability-research | #wordpress | #xss

12.

Evading CSP with DOM-based dangling markup

research | 2021-07-19 07:19 | portswigger.net | original ↗ | #browser-security | #xss | #portswigger

13.

Bypassing CSP with policy injection

research | 2020-09-04 14:31 | portswigger.net | original ↗ | #bug-bounty | #portswigger | #chrome

14.

h1-415 CTF Winners Announced!

blog | 2020-02-03 23:00 | hackerone.com | original ↗ | #account-takeover | #ctf | #hackerone

15.

Bypassing CSP using polyglot JPEGs

research | 2019-06-14 12:15 | portswigger.net | original ↗ | #burp-suite | #web-security | #xss