>Firefox treats scripts running from bookmarklets as being scripts that are directly on the page. This means that unless you list `script-src: unsafe-inline`, y

>Firefox treats scripts running from bookmarklets as being scripts that are directly on the page. This means that unless you list `script-src: unsafe-inline`, your CSP policy can disable the user's ability to use bookmarklets. This is the single instance where a site owner has control over the user agent without the user having ultimate veto powers. about:config -> security.csp.enable -> false