Violation class: embedded and nested browsing contexts.
These violations are neither inline code, nor ordinary subresources, nor scripted
connections — they are containers that embed other content. They exercise the
fallback directives that are most often missing from a collector's mapping,
because none of them is named in the policy: all four fall through to
default-src.
Expected reports (5):
manifest-src — cross-origin <link rel=manifest>frame-src — cross-origin <iframe>object-src — cross-origin <object>object-src — cross-origin <embed>worker-src — Worker from a blob: URLThe blob: worker is the subtle one: 'self' does not
cover the blob: scheme, so a same-origin-looking URL still violates.
Its blocked-uri is a blob: URI, which is worth checking
survives storage intact.
Outcomes: worker: pending