Click here to download the Blitz Browser!

WPT

wpt / content-security-policy / navigation / to-javascript-parent-initiated-check-csp-order.html

Spec: Content Security Policy ↗

Runs: Chrome 155.0.8041.0 (wpt@18be93235, 2026-09-04) | Firefox 157.0a1 (wpt@18be93235, 2026-09-04) | Safari 251 preview (wpt@2c385f65e, 2026-09-04) | Ladybird 1.0-70fb3 (wpt@0c9001c53, 2026-09-04) | Servo Servo 0.6 (wpt@2c385f65e, 2026-09-04) | Blitz a50cb8971 (wpt@a95401e4e, 2026-09-03)

View on the Blitz WPT dashboard | Open test on wpt.live | wpt.fyi

ChromeFirefoxSafariLadybirdServoBlitz
Total7/77/77/70/77/7NOT RUN
SubtestChromeFirefoxSafariLadybirdServoBlitz
Executing the javascript URL should violate the parent's CSP for iframe.contentWindow.location.hrefPASSPASSPASSFAILPASS—
Executing the javascript URL should violate the parent's CSP for iframe.srcPASSPASSPASSFAILPASS—
Executing the javascript URL should violate the parent's CSP for a[target=iframeWithScriptSrcNone].hrefPASSPASSPASSFAILPASS—
Executing the javascript URL should violate the parent's CSP for a[target=otherTabWithScriptSrcNone].hrefPASSPASSPASSFAILPASS—
Executing the javascript URL should violate the parent's CSP for area[target=iframeWithScriptScrcNone].hrefPASSPASSPASSFAILPASS—
Executing the javascript URL should violate the parent's CSP for area[target=otherTabWithScriptSrcNone].hrefPASSPASSPASSFAILPASS—
Executing the javascript URL should violate the parent's CSP for otherTabWithScriptSrcNone.location.hrefPASSPASSPASSFAILPASS—