[wwweston]

Bookmarklets are exempt from CSP by spec.

And as far as I can tell, they should be. They're a natural intermediate step between nothing and extensions, and there's not really security problems they have that extensions don't.

If there's a problem here, it's that browsers (some, at least) aren't following the spec.