Pedro Fortuna
CSP turned eleven this year. It is the standard the web ultimately adopted to decide which scripts a page is allowed to load and execute, and it now sits at the center of how we think about XSS mitigation, third-party script risk, and client-side supply-chain compromise.
The problem is that CSP was designed as a fetch-time control. It evaluates origins, nonces, hashes, and directives when resources are requested, yet it is often expected to provide guarantees about what trusted code does after execution begins. The bypass literature tells a different story.
This talk examines five representative CSP bypass classes, and uses them to expose the gap between controlling what may be loaded and governing behaviour at runtime. It also raises broader questions of script governance, supply-chain security, and the distinction between fetch-time and runtime security controls.
I conclude by introducing an open learning platform that contains a comprehensive catalogue of CSP bypass techniques.
Pedro Fortuna
Co-Founder & CTO of Jscrambler
Pedro Fortuna is a security researcher, entrepreneur, and CTO of Jscrambler. For more than 15 years, his work has focused on web security, client-side security, reverse engineering, malware analysis, and software supply chain threats. He is the author of multiple security patents, a contributor to OWASP, and a member of the PCI Security Standards Council Board of Advisors.
Pedro regularly presents security research at international conferences and spends much of his time investigating how modern web applications fail in practice, from browser-side attacks and web skimming campaigns to the security implications of emerging technologies.