Blind trust: stealing credentials through CSP

PortSwigger ResearchNovember 11, 2026Identity AppSec

Content Security Policy is supposed to be the safety net that stops an HTML injection from turning into XSS. Usually it works. But sometimes it doesn't, because the policy allows-lists a domain that h

Summary from PortSwigger Research.

Read the full article at PortSwigger Research

Explained

The technology and terms in this story. Learn more

WeaknessCross-site scripting · XSSGetting a website to run an attacker's JavaScript in other visitors' browsers.

Blind trust: stealing credentials through CSP

Explained

More in Identity

Hackers use AntiFox AI agents in AWS credential-theft attacks

Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords

Hackers Advertise a $1,000 Gmail Tool That Allegedly Survives Password Resets

SN 1104: The hole in OpenSSH - Password Bypass in Plain Sight

SANS Stormcast Wednesday, November 11th, 2026: Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103)