diff --git a/extensions/common/csp_validator.cc b/extensions/common/csp_validator.cc
index a5042114c5929..462c45a4dc5c3 100644
--- a/extensions/common/csp_validator.cc
+++ b/extensions/common/csp_validator.cc
@@ -69,9 +69,14 @@ const char* const kHashSourcePrefixes[] = {
   "'sha512-"
 };
 
-// TODO(karandeepb): This is not the same list as used by the CSP spec. See
-// https://infra.spec.whatwg.org/#ascii-whitespace.
-const char kWhitespaceDelimiters[] = " \t\r\n";
+// Match ASCII whitespace per https://infra.spec.whatwg.org/#ascii-whitespace.
+// This MUST include U+000C (form feed) to match the runtime parsers in
+// services/network/public/cpp/web_sandbox_flags.cc (kHtmlWhitespace) and
+// services/network/public/cpp/content_security_policy.cc — otherwise tokens
+// like "allow-same-origin\ffoo" pass validation here but split into
+// "allow-same-origin" + "foo" at runtime, defeating the exact-match check in
+// ContentSecurityPolicyIsSandboxed.
+const char kWhitespaceDelimiters[] = " \t\r\n\f";
 
 constexpr char kChromeResourcesUrl[] = "chrome://resources";