It looks like the Mozilla-Central tip doesn't support path-based host policies: https://mxr.mozilla.org/mozilla-central/source/content/base/src/nsCSPUtils.cpp#2

It looks like the Mozilla-Central tip doesn't support path-based host policies: https://mxr.mozilla.org/mozilla-central/source/content/base/src/nsCSPUtils.cpp#293 https://mxr.mozilla.org/mozilla-central/source/content/base/... It is still vulnerable if a site redirects to a different domain (or if framing is allowed, loads resources from a different domain) depending on private state. The hash directive, from the CSP 1.1 draft and implemented in Mozilla Central, however, probably opens up a whole lot of new problems - you can check whether a given script matches a given hash.