# javascript: iframe src bypasses CSP

User or config URL assigned to iframe src without scheme allowlist, letting javascript: run past CSP

_Area: Web injection and code execution. Seen in 3 disclosed reports; 3 confirmed bounties, median $500, range $300-$3,000; latest 2022-09-02. Updated 2026-10-24._

## How it works
A URL that a user or config controls is placed into an iframe's `src` without checking its scheme. The page relies on its Content Security Policy to stop script execution, but CSP is enforced per navigation and execution context. When the URL is a `javascript:` URL, the browser runs it in the frame's context and the page's `script-src` restrictions are skipped. The broken assumption is that CSP covers every way script can start; in fact it only covers the sinks the browser checks, and a `javascript:` iframe src was one it did not check [E1](https://bugbountylibrary.com/r/blog%3Aweizman-github-io-2020-09-02-csp-vuln.md).

## Where it shows up
- Any `iframe.src` fed from request data, stored config, or a route parameter, with no scheme allowlist.
- Code that treats CSP as the only defense and does not validate the URL before assigning it to a frame.
- Alternate sinks worth testing with the same payload: `srcdoc` and event handlers, since policy checks may differ per context [E1](https://bugbountylibrary.com/r/blog%3Aweizman-github-io-2020-09-02-csp-vuln.md).

## How to review
Find every assignment to a frame `src` and trace the value to its source. The invariant: a URL placed in a frame must be parsed and its scheme checked against an allowlist (`https:` only) before assignment; the sink itself must reject non-http(s) schemes. Do not accept CSP as the control here. Confirm the browser version in scope actually enforces CSP on `javascript:` frame navigations; older Chromium did not [E1](https://bugbountylibrary.com/r/blog%3Aweizman-github-io-2020-09-02-csp-vuln.md).

## Variants seen
- `javascript:` URL in iframe src skipping CSP `script-src` [E1](https://bugbountylibrary.com/r/blog%3Aweizman-github-io-2020-09-02-csp-vuln.md).

## Why fixes fail
Relying on CSP alone fails because enforcement differs per context; the same payload blocked as a normal script ran through the iframe sink [E1](https://bugbountylibrary.com/r/blog%3Aweizman-github-io-2020-09-02-csp-vuln.md).

## Impact and severity
Led to script execution in privileged contexts: CSP bypass in Chromium 73-83 [E1](https://bugbountylibrary.com/r/blog%3Aweizman-github-io-2020-09-02-csp-vuln.md). Severity is high where the frame is privileged or the payload is stored; worse when CSP is assumed to protect and no scheme check exists.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aweizman-github-io-2020-09-02-csp-vuln.md
- E2: https://bugbountylibrary.com/r/h1%3A662083.md
- E3: https://bugbountylibrary.com/r/bc%3A6fbe09ba-112c-44dd-b06c-31eeb8305e9a.md