Search results

Ambiguity regarding frame-src enforcement for <object> and <embed> child navigables

Status: Open.

#816 In w3c/webappsec-csp;

· nikosfanou opened on May 22, 2026

Clarification RFC 7234 caches for present nonce-sources

Status: Open.

#815 In w3c/webappsec-csp;

· codingjoe opened on May 7, 2026

Clarify object-src behavior when plugin content has no associated URL

Status: Open.

#814 In w3c/webappsec-csp;

· roberto-apple opened on May 1, 2026

Embedded enforcement links are broken

Status: Open.

#811 In w3c/webappsec-csp;

· domfarolino opened on Apr 9, 2026

frame-src WPT test expects path to be stripped when loading cross-origin URL

Status: Open.

#809 In w3c/webappsec-csp;

· TimvdLippe opened on Mar 28, 2026

Proposal: CSP control over interactive HTTP authentication for subresources

Status: Open.

#801 In w3c/webappsec-csp;

· nirmalk401 opened on Feb 16, 2026

Integration point for WebDriver BiDi CSP bypass

addition/proposalNew features or enhancementsNew features or enhancements

Status: Open.

#798 In w3c/webappsec-csp;

· juliandescottes opened on Feb 5, 2026

Providing a directive for XSLT

Status: Open.

#797 In w3c/webappsec-csp;

· Tachi107 opened on Jan 21, 2026

Attackers can exploit CSP to block requests to legitimate domains

addition/proposalNew features or enhancementsNew features or enhancements

needs implementer interestMoving the issue forward requires implementers to express interestMoving the issue forward requires implementers to express interest

needs testsMoving the issue forward requires someone to write testsMoving the issue forward requires someone to write tests

Status: Open.

#792 In w3c/webappsec-csp;

· MartijnCuppens opened on Nov 25, 2025

Broken links in Content Security Policy Level 3

Status: Open.

#789 In w3c/webappsec-csp;

· dontcallmedom-bot opened on Nov 3, 2025

Incorrect assertion in Obtain the deprecated serialization of violation

Status: Open.

#788 In w3c/webappsec-csp;

· Lubrsi opened on Oct 30, 2025

Incorrect assertion in form-action Pre-Navigation Check

Status: Open.

#782 In w3c/webappsec-csp;

· Lubrsi opened on Jul 28, 2025