# CSP allowlist bypass via trusted hosts

Allowlisted origins or directives that serve user-influenced JS, embeds, frameworks, or exfil endpoints

_Area: Web injection and code execution. Seen in 7 disclosed reports; 2 confirmed bounties: $750 and $5,000; latest 2026-09-10. Updated 2026-10-23._

## How it works
A CSP allowlist says "only these origins may supply executable JS." The broken assumption is that an allowlisted origin serves only trusted, fixed code. In practice allowlisted hosts expose user-controllable surfaces: JSONP callbacks, oEmbed/embed providers, bundled frameworks, or legacy SWF that loads remote config. If an attacker can steer any such surface, the allowlist grants execution of attacker-chosen JS under the protected origin. The same logic applies to other directives: an allowlisted `img-src` host that logs arbitrary query strings becomes an exfiltration channel [E7](https://bugbountylibrary.com/r/h1%3A199779.md). Readable nonces and misconfigured iframe sandboxes are co-occurring weaknesses that compound the allowlist problem, not part of its logic.

## Where it shows up
- `script-src` listing broad third-party paths (CDNs, `google.com/recaptcha/`, embed providers) rather than exact files [E4](https://bugbountylibrary.com/r/h1%3A2279346.md).
- JSONP/callback sinks accepting a `_jsonp`-style parameter, filtered only to `[\w.]` [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-bypass-csp-using-wordpress-by-abusing-same-origin-method-execution.md).
- Script loaders deriving their host from a cookie settable by a sibling subdomain [E2](https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2017-08-30-uber-xss-via-cookie.md).
- oEmbed/embed whitelists where the provider's user content runs in the host context [E3](https://bugbountylibrary.com/r/h1%3A411329.md).
- Frameworks (e.g. Angular) bundled on an allowlisted path that compile inline expressions [E4](https://bugbountylibrary.com/r/h1%3A2279346.md).
- Legacy SWF assets that load a remote `config` URL and call ExternalInterface [E6](https://bugbountylibrary.com/r/h1%3A254269.md).
- `img-src` allowlisting analytics hosts that log arbitrary query params [E7](https://bugbountylibrary.com/r/h1%3A199779.md).
- Nonces readable in the DOM [E4](https://bugbountylibrary.com/r/h1%3A2279346.md); iframes with both `allow-scripts` and `allow-same-origin` on the app origin [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-jmc6-2wr8-h3wj.md).

## How to review
The invariant: every allowlisted origin and path must serve only code the site controls, and no allowlisted response may reflect attacker input into executable JS or leak page content. For each entry ask: does it host user content, JSONP, a framework that evaluates markup, or a logging endpoint? For JSONP, confirm the callback is validated against a strict identifier grammar AND cannot traverse properties to reach DOM methods — grammar alone is insufficient [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-bypass-csp-using-wordpress-by-abusing-same-origin-method-execution.md). For loaders, confirm the script host is not sourced from a cookie or other cross-subdomain-writable value [E2](https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2017-08-30-uber-xss-via-cookie.md). For embeds, confirm provider JS runs sandboxed, not in the privileged context [E3](https://bugbountylibrary.com/r/h1%3A411329.md). For `img-src`, confirm allowlisted hosts cannot log attacker-chosen strings [E7](https://bugbountylibrary.com/r/h1%3A199779.md). Treat readable nonces and `allow-same-origin`+`allow-scripts` sandboxes as compounding risks [E4](https://bugbountylibrary.com/r/h1%3A2279346.md)[E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-jmc6-2wr8-h3wj.md).

## Variants seen
- JSONP callback restricted to word/dot chars, chained via Same Origin Method Execution to invoke DOM methods [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-bypass-csp-using-wordpress-by-abusing-same-origin-method-execution.md).
- JSONP loader building its script URL from a cookie settable by any sibling subdomain [E2](https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2017-08-30-uber-xss-via-cookie.md).
- Whitelisted oEmbed provider executing attacker JS in a privileged chat client with protocol-handler access [E3](https://bugbountylibrary.com/r/h1%3A411329.md).
- Allowlisted reCAPTCHA path hosting Angular, bootstrapped via `ng-on-error`, plus nonce theft [E4](https://bugbountylibrary.com/r/h1%3A2279346.md).
- Outdated FlowPlayer SWF loading remote config JS [E6](https://bugbountylibrary.com/r/h1%3A254269.md).
- `img-src` analytics host plus dangling markup for exfiltration [E7](https://bugbountylibrary.com/r/h1%3A199779.md).
- Port-preview iframe with `allow-same-origin`+`allow-scripts` on the app origin [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-jmc6-2wr8-h3wj.md).

## Why fixes fail
Narrow callback filtering still permits method chaining [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-bypass-csp-using-wordpress-by-abusing-same-origin-method-execution.md); path-level allowlists admit bundled frameworks [E4](https://bugbountylibrary.com/r/h1%3A2279346.md); cookie-sourced hosts remain attacker-writable across subdomains [E2](https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2017-08-30-uber-xss-via-cookie.md); leftover static sandbox strings survive migrations [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-jmc6-2wr8-h3wj.md).

## Impact and severity
Escalates HTML injection to full XSS/RCE [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-bypass-csp-using-wordpress-by-abusing-same-origin-method-execution.md), cross-subdomain script execution [E2](https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2017-08-30-uber-xss-via-cookie.md), privileged-context code execution and OS protocol invocation [E3](https://bugbountylibrary.com/r/h1%3A411329.md), arbitrary script loading [E4](https://bugbountylibrary.com/r/h1%3A2279346.md), account takeover via token theft [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-jmc6-2wr8-h3wj.md), and data exfiltration [E7](https://bugbountylibrary.com/r/h1%3A199779.md). Severity rises with context privilege and broad path allowlists.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-bypass-csp-using-wordpress-by-abusing-same-origin-method-execution.md
- E2: https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2017-08-30-uber-xss-via-cookie.md
- E3: https://bugbountylibrary.com/r/h1%3A411329.md
- E4: https://bugbountylibrary.com/r/h1%3A2279346.md
- E5: https://bugbountylibrary.com/r/ghsa%3AGHSA-jmc6-2wr8-h3wj.md
- E6: https://bugbountylibrary.com/r/h1%3A254269.md
- E7: https://bugbountylibrary.com/r/h1%3A199779.md