Note that per the CSP spec, browser extensions should NOT be affected by CSP.  The fact that they are in browsers is technically a bug, caused by the fact that once you&#x27;ve injected stuff into a page browsers don&#x27;t so much track where it came from...<p>This does mean that currently CSP can stop various malware-ish extensions, but also that it stops legitimate ones (e.g. say an extension wants to apply a certain font that the user finds more readable to the entire page).  It&#x27;s a tough tradeoff.