# CSP Bypasses & open redirect

Have you encountered that csp allows content from google.com or you have filter that allows google.com for open redirect or any other vuln.

Behold here comes google.com it's own redirect

<figure><img src="https://1775328623-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcqyroGfei3tKtTi25FT7%2Fuploads%2FXq8KCgamIOl98ZRCtwXX%2Fimage.png?alt=media&#x26;token=3c941bc7-cfcf-44d2-8c22-dfb389a2a2a1" alt=""><figcaption></figcaption></figure>

I think he has shared this technique on his twitter too.



App scripts are hosted on google.com and can be used too for csp bypasses, this blog also shares same technique.



Link : [https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration/](https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration/)
