diff --git a/extensions/common/csp_validator.cc b/extensions/common/csp_validator.cc
index edfaee19c15bd..8661a04ce132a 100644
--- a/extensions/common/csp_validator.cc
+++ b/extensions/common/csp_validator.cc
@@ -71,8 +71,13 @@ const char* const kHashSourcePrefixes[] = {
   "'sha512-"
 };
 
-// https://infra.spec.whatwg.org/#ascii-whitespace.
-const char kWhitespaceDelimiters[] = " \t\r\n\f";
+// https://infra.spec.whatwg.org/#ascii-whitespace, plus U+000B VT to match
+// base::kWhitespaceASCII used by the runtime CSP parser
+// (services/network/public/cpp/content_security_policy/). Without VT here, a
+// directive like "sandbox<VT>allow-same-origin ..." is rejected by neither
+// ContentSecurityPolicyIsLegal nor ContentSecurityPolicyIsSandboxed, but the
+// runtime parser splits on VT and applies allow-same-origin.
+const char kWhitespaceDelimiters[] = " \t\r\n\f\v";
 
 constexpr char kChromeResourcesUrl[] = "chrome://resources";
 constexpr const char* const kExtensionsAllowedToUseChromeResources[] = {