A security mechanism bypass is a flaw that lets an attacker evade a control that should stop, delay, or limit abuse. The control may be a sandbox, authentication check, permission gate, content filter, or exploit mitigation. Instead of directly defeating the whole defense, the attacker finds a weakness in the layer meant to contain the threat.
In browser security, bypasses matter because many defenses work in layers. For example, sandboxing and site isolation reduce the impact of malicious web content, but a bypass can let hostile code escape a boundary, reach a more privileged component, or avoid a check that should block dangerous input. In real attacks, bypasses often turn a low-impact bug into a serious one by weakening the protection around it. Defenders look for them in patch reviews, exploit testing, and hardening audits, because fixing the bypass can be as important as fixing the main vulnerability.