Issues

• 'strict-dynamic' might be bypassed with <link rel=modulepreload>

  w3c/webappsec-csp#823 · Filter by author lebr0nli opened on Sep 17, 2026

• Enhancing import map handling under CSP without script-src 'unsafe-inline' in effect

  w3c/webappsec-csp#822 · Filter by author jnsttl opened on Aug 26, 2026

• Should csp-hash/csp-violation be reported to ReportingObserver when no report-to directive is specified?

  w3c/webappsec-csp#819 · Filter by author fred-wang opened on Aug 4, 2026

• Ambiguity regarding frame-src enforcement for <object> and <embed> child navigables

  w3c/webappsec-csp#816 · Filter by author nikosfanou opened on May 22, 2026

• Clarification RFC 7234 caches for present nonce-sources

  w3c/webappsec-csp#815 · Filter by author codingjoe opened on May 7, 2026
  1

• Clarify object-src behavior when plugin content has no associated URL

  w3c/webappsec-csp#814 · Filter by author roberto-apple opened on May 1, 2026
  5

• Embedded enforcement links are broken

  w3c/webappsec-csp#811 · Filter by author domfarolino opened on Apr 9, 2026

• frame-src WPT test expects path to be stripped when loading cross-origin URL

  w3c/webappsec-csp#809 · Filter by author TimvdLippe opened on Mar 28, 2026
  1

• Proposal: CSP control over interactive HTTP authentication for subresources

  w3c/webappsec-csp#801 · Filter by author nirmalk401 opened on Feb 16, 2026

• Integration point for WebDriver BiDi CSP bypass

  addition/proposal
  w3c/webappsec-csp#798 · Filter by author juliandescottes opened on Feb 5, 2026

• Providing a directive for XSLT

  w3c/webappsec-csp#797 · Filter by author Tachi107 opened on Jan 21, 2026

• Attackers can exploit CSP to block requests to legitimate domains

  addition/proposalneeds implementer interestneeds tests
  w3c/webappsec-csp#792 · Filter by author MartijnCuppens opened on Nov 25, 2025
  11

• Broken links in Content Security Policy Level 3

  w3c/webappsec-csp#789 · Filter by author dontcallmedom-bot opened on Nov 3, 2025

• Incorrect assertion in Obtain the deprecated serialization of violation

  w3c/webappsec-csp#788 · Filter by author Lubrsi opened on Oct 30, 2025

• Incorrect assertion in form-action Pre-Navigation Check

  w3c/webappsec-csp#782 · Filter by author Lubrsi opened on Jul 28, 2025

• report-multiple-violations-{01,02} don't conform with the spec

  w3c/webappsec-csp#781 · Filter by author TimvdLippe opened on Jul 11, 2025

• CSP report referrer should adhere to referrer policy

  w3c/webappsec-csp#775 · Filter by author imolorhe-stripe opened on Jul 7, 2025
  1

• setting cssText rather than style

  w3c/webappsec-csp#774 · Filter by author johanneswilm opened on Jul 1, 2025
  2

• Making CSP more usable for organizations at scale

  w3c/webappsec-csp#736 · Filter by author swijckmans opened on Jun 18, 2025
  11

• Implementation differences with "Strip URL for use in reports"

  w3c/webappsec-csp#735 · Filter by author evilpie opened on Jun 13, 2025
  19

• Add Back The prefetch-src Directive to The CSP Header

  w3c/webappsec-csp#733 · Filter by author zphrs opened on Jun 6, 2025
  3

• report-to directive to support multiple endpoints

  w3c/webappsec-csp#785 · Filter by author armenzg opened on May 23, 2025
  6

• Strict-Dynamic CSP doesn't prevent execution of parser inserted scripts via document.createRange().createContextualFragment

  w3c/webappsec-csp#708 · Filter by author andreituicu opened on Feb 26, 2025

• "source file" lacks a real defintion

  clarificationinterop
  w3c/webappsec-csp#707 · Filter by author evilpie opened on Feb 14, 2025
  2

• connect-src test suite allows multiple non-interopable implementations.

  interop
  w3c/webappsec-csp#706 · Filter by author lukewarlow opened on Jan 30, 2025
  7