> The authors conducted a large-scale study of browser extensions from the Chrome web store and found that many extensions tamper with the CSP of a page. Hence,

> The authors conducted a large-scale study of browser extensions from the Chrome web store and found that many extensions tamper with the CSP of a page. Hence, they propose an endorsement mechanism that allowed an extension to ask the web page for permission before changing the security policy. Terrible idea, and scary. A user agent should never requires permissions from a site for its served content to be modified. At most I rather propose having a new permission in the extension API to inform the user that an extension requires the ability to relax a Content Security Policy (further restricting the effective Content Security Policy would not require any special permission).