Browser enforces Content-Security-Policy

The scan loads a probe page in an iframe. The probe is served with Content-Security-Policy: default-src 'none'; script-src 'nonce-<random>'; img-src 'self' and contains three things: an inline script without a nonce that would set a flag, a nonced script that listens for the securitypolicyviolation event and posts results to the parent, and an image from a disallowed origin. The check passes when the un-nonced script did not run, a violation event fired with blockedURI of inline, and the image failed to load. The nonced script also calls eval() inside a try/catch to confirm 'unsafe-eval' is blocked. Limits: violations raised by your own extensions injecting scripts are filtered out by matching the event's sample to our test script; the check reflects your browser plus its extensions, not the policies of sites you visit.

CSP is the main defence in depth against cross-site scripting: even if an attacker gets markup into a page, the browser refuses to run script the policy did not authorise. A browser that does not enforce it turns every site's CSP into decoration. In practice this failure comes from extensions that disable CSP (a developer convenience left on), from adware that strips CSP so it can inject its own scripts into every page, and from content-rewriting proxies. Old browsers without CSP Level 2 support are rare now.

Update the browser. Look for extensions described as "disable CSP", "CSP bypass" or header editors and remove them or scope them to the sites you develop on. Rerun the scan in a private window with extensions disabled; if it passes there, an extension is responsible. If it fails even then, check the system proxy settings and run a malware scan, since adware commonly strips this header. Site owners: see the CSP presence check, weak CSP directives and the practical CSP guide. The attack it prevents is described in cross-site scripting explained.