| blob: URLs are same-origin with the page in which they were created, but explicitly do not match the 'self' or '*' source in CSP directives because they are more akin to 'unsafe-inline' content. | |
| PASS Expecting logs: ["violated-directive=script-src-elem"] | |