https://anthr4ce.github.io/tags/csp-bypass/Recent content in Csp-Bypass on Anthrace | CTF WriteupsHugoen-usSun, 11 Jan 2026 00:00:00 +0000https://anthr4ce.github.io/ctf-writeups/uoftctf-2026/Sun, 11 Jan 2026 00:00:00 +0000https://anthr4ce.github.io/ctf-writeups/uoftctf-2026/<hr> <h1 id="web-challenge-----dom-clobbering--csp-bypass--rce-of-seleniums-webdriver-bidi-protocol"> Web Challenge - - DOM clobbering + CSP bypass + RCE of Selenium&rsquo;s WebDriver BiDi protocol <a class="heading-link" href="#web-challenge-----dom-clobbering--csp-bypass--rce-of-seleniums-webdriver-bidi-protocol"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h1> <p>It&rsquo;s been a while since I had that much fun with a client-side challenge.</p> <p>Pasteboard is a note-sharing web application where users can create and view notes. The challenge includes an admin bot that visits reported notes, so right off the bat I knew we were dealing with some client-side shenanigans.</p>