ALERT: /PASS/
CONSOLE MESSAGE: line 1: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".

 WebAssembly should be blocked in the iframe, but inline script should be allowed.