https://medium.com/making-instapaper/bookmarklets-are-dead-d...
Also see: content security policy (CSP)