A zero-day flaw in Chromium-based web browsers for Windows, Mac and Android could have allowed attackers to entirely bypass Content Security Policy (CSP) rules since Chrome 73. Facebook, Wells Fargo, Zoom, Gmail, WhatsApp, Investopedia, ESPN, Roblox, Indeed, TikTok, Instagram, Blogger, Quora, and Quora were susceptible to the CSP bypass. The same flaw was also highlighted by Tencent Security Xuanwu Lab more than a year ago, just a month after the release of Chrome 73 in March 2019.
Source: https://thehackernews.com/2020/08/chrome-csp-bypass.html