A February 2026 audit of a European banking platform revealed that a Taboola advertising pixel, approved by the institution as a trusted third party, was silently routing authenticated user session data to a Temu tracking endpoint via a 302 HTTP redirect chain, entirely outside the bank’s awareness, consent framework, or security controls. The mechanism exploits a structural gap in how browsers enforce Content Security Policy: once a redirect chain’s first hop clears the CSP allow-list, every subsequent destination inherits that trust transitively, meaning the bank’s carefully maintained policy was bypassed by a vendor relationship it never approved or audited. This incident signals that fourth-party supply chain risk on the client side has reached regulated financial infrastructure, and that CSP, long treated as a meaningful control boundary, provides less protection than most security programs assume when third-party vendors introduce redirect chains.