Enabling the `integrity ` attribute on iframes would help: https://github.com/w3c/webappsec-subresource-integrity/issues/21 https://github.com/w3c/webappsec-sub

Enabling the `integrity ` attribute on iframes would help: https://github.com/w3c/webappsec-subresource-integrity/issues/21 https://github.com/w3c/webappsec-subresource-integrity/issue... But then you'd also want the frame content to use `integrity` on nested resoures. CSP frame-src can help for now.