3 ms·
Huh, there is no alert, but the script node is there in the DOM. I'm confused.
Huh, there is no alert, but the script node is there in the DOM. I'm confused.
Probably because it gets dynamically added to the DOM tree and AFAIK stuff like that does not get executed.
Check your devtools: the inline script is violating the CSP, so your browser is saving you at the last line of defense.