ControlCurrentbrowser security planning
Content execution

CSP hash sources

Authorises exact inline script or style content through cryptographic source expressions.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.0.7.

BrowserMinimumOutcomeReason
Chrome150Not enough browser dataBCD 8.0.7 does not publish a standalone compatibility statement for CSP hash source expressions.
Edge150Not enough browser dataBCD 8.0.7 does not publish a standalone compatibility statement for CSP hash source expressions.
Firefox152Not enough browser dataBCD 8.0.7 does not publish a standalone compatibility statement for CSP hash source expressions.
Safari26.5Not enough browser dataBCD 8.0.7 does not publish a standalone compatibility statement for CSP hash source expressions.
Chrome for Android150Not enough browser dataBCD 8.0.7 does not publish a standalone compatibility statement for CSP hash source expressions.
Firefox for Android152Not enough browser dataBCD 8.0.7 does not publish a standalone compatibility statement for CSP hash source expressions.
Safari on iOS26.5Not enough browser dataBCD 8.0.7 does not publish a standalone compatibility statement for CSP hash source expressions.
Android WebView150Not enough browser dataBCD 8.0.7 does not publish a standalone compatibility statement for CSP hash source expressions.
Samsung Internet29.0Not enough browser dataBCD 8.0.7 does not publish a standalone compatibility statement for CSP hash source expressions.

What this feature can and cannot do

Helps protect against

  • Injected inline script execution
  • Injected inline style execution

Does not guarantee

  • Modified content without a matching policy update
  • Unsafe external scripts
  • Permitted code that creates dangerous sinks

What you need before using it

  • Stable inline content
  • A CSP source policy with matching digests

Fallback to keep in place

Use nonces or external resources under a restrictive CSP when hash maintenance is unsuitable.