Bookmarklets are exempt from CSP by spec. And as far as I can tell, they should be. They're a natural intermediate step between nothing and extensions, and the

Bookmarklets are exempt from CSP by spec. And as far as I can tell, they should be. They're a natural intermediate step between nothing and extensions, and there's not really security problems they have that extensions don't. If there's a problem here, it's that browsers (some, at least) aren't following the spec.