PortSwigger Said Chrome Updates Broke Its CSRF Lab. My Tests Tell a Different Story

This story was originally published on HackerNoon at: https://hackernoon.com/portswigger-said-chrome-updates-broke-its-csrf-lab-my-tests-tell-a-different-story.

PortSwigger removed a SameSite Lax CSRF bypass lab after citing Chrome updates. Independent tests across 8 Chrome versions suggest the bypass still works.

Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity.

You can also check exclusive content about #web-security, #bug-bounty, #portswigger, #infosec, #penetration-testing, #cybersecurity, #csrf, #hackernoon-top-story, and more.

This story was written by: @rivenx173. Learn more about this writer by checking @rivenx173's about page,

and for more stories, please visit hackernoon.com.

On August 11, 2026, I was one lab away from finishing PortSwigger’s CSRF module when the final lab, “SameSite Lax bypass via cookie refresh,” refused to start. PortSwigger support told me recent Chrome updates to the victim browser had broken it, and within 24 hours, they had quietly removed both the lab and the theory section titled “Bypassing SameSite Lax restrictions with newly issued cookies,” from the Academy entirely. I accepted that explanation for a while. Then, weeks later, I went looking for any public record of Chrome actually removing this two-minute grace window, and found nothing. So I built a two-site Python proof-of-concept and tested it across 8 Chrome versions to find out for myself whether the bypass still exists.Short answer: it does.