CSP nonce sources · ControlCurrent

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

Browser	Minimum	Outcome	Reason
Chrome	155	Not enough browser data	BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.
Edge	154	Not enough browser data	BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.
Firefox	157	Not enough browser data	BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.
Safari	27	Not enough browser data	BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.
Chrome for Android	155	Not enough browser data	BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.
Firefox for Android	157	Not enough browser data	BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.
Safari on iOS	27	Not enough browser data	BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.
Android WebView	155	Not enough browser data	BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.
Samsung Internet	30.0	Not enough browser data	BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.

The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

No exact compatibility mapping is available for this feature.

Edge

No exact compatibility mapping is available for this feature.

Firefox

No exact compatibility mapping is available for this feature.

Safari

No exact compatibility mapping is available for this feature.

Chrome for Android

No exact compatibility mapping is available for this feature.

Firefox for Android

No exact compatibility mapping is available for this feature.

Safari on iOS

No exact compatibility mapping is available for this feature.

Android WebView

No exact compatibility mapping is available for this feature.

Samsung Internet

No exact compatibility mapping is available for this feature.

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

A fixed result snapshot

What those browser runs reported

Reviewed 11 October 2026

These are published results from specific stable-labelled browser builds. They are separate from the compatibility calculation and from evidence about your application. File outcomes and subtest counts stay separate. OK describes a completed harness, which can still contain failing subtests; Pass and Fail can also describe tests without a harness.

Exact browser builds, systems and source revision

firefox 157.0 · linux 22.04 · stable
Run 4877098740350976 · 2026-10-06T10:36:34.451Z to 2026-10-06T11:50:28.028Z
cc74d2669f5de548e808779877d1d33339ec5115
safari 27.0 (22625.1.29.11.27) · mac 27.0 · stable
Run 5164107446878208 · 2026-10-06T06:14:03.64Z to 2026-10-06T09:13:55.471Z
cc74d2669f5de548e808779877d1d33339ec5115
chrome 154.0.8037.92 · linux 22.04 · stable
Run 6218298311311360 · 2026-10-06T07:44:01.102Z to 2026-10-06T11:57:16.569Z
cc74d2669f5de548e808779877d1d33339ec5115

“Stable” is the upstream run label. Complete runtime flags were not supplied by the summary API. These results do not cover every browser version, mobile platform or operating system.

CSP script-src

content-security-policy/script-src

90 test files retained from 90 returned search matches. Only this exact directory prefix is included. This is the returned result inventory, not a claim that every possible suite test ran.

Browser build	Subtests passed / reported	File outcomes
firefox 157.0	182 / 214	88 OK · 1 Error · 1 Timeout
safari 27.0 (22625.1.29.11.27)	177 / 213	85 OK · 1 Error · 4 Timeout
chrome 154.0.8037.92	185 / 214	88 OK · 2 Error

Read all 90 retained file results

Test file	firefox	safari	chrome
`audioworklet-eval-blocked.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`audioworklet-trusted-types-eval-blocked.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`eval-allowed-in-report-only-mode-and-sends-report.html`	OK · 2/2 subtests	OK · 1/2 subtests	OK · 2/2 subtests
`eval-allowed-in-report-only-mode.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/iso-8859-1.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/iso-8859-3.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/iso-8859-7.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/iso-8859-9.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/utf-8-lone-surrogate.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/utf-8.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`injected-inline-script-allowed.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`injected-inline-script-blocked.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`javascript-window-open-blocked.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`non-nonceable-elements.html`	OK · 10/10 subtests	OK · 7/10 subtests	OK · 10/10 subtests
`nonce-enforce-blocked.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`nonce-with-trailing-characters-blocked.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-1_1.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-1_10_1.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_10.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_2_1.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_2.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-1_3.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_4_1.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-1_4_2.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_4.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-event-handler-on-inline-script.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-multiple-policies-multiple-hashing-algorithms.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-multiple-policies-one-using-hashing-algorithms.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-overrides-default-src.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-report-only-policy-works-with-external-hash-policy.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-report-only-policy-works-with-hash-policy.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-sri_hash.sub.html`	OK · 12/12 subtests	OK · 12/12 subtests	OK · 12/12 subtests
`script-src-strict_dynamic_and_unsafe_eval_eval.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_and_unsafe_eval_new_function.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_discard_source_expressions.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_double_policy_different_nonce.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-strict_dynamic_double_policy_honor_source_expressions.sub.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-strict_dynamic_double_policy_report_only.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_eval.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_hashes.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-strict_dynamic_in_img-src.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_javascript_uri.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_meta_tag.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-strict_dynamic_modulepreload_parser_inserted_module.html`	OK · 2/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-strict_dynamic_new_function.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_non_parser_inserted_incorrect_nonce.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_non_parser_inserted_module.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-strict_dynamic_non_parser_inserted.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-strict_dynamic_parser_inserted_correct_nonce.html`	OK · 8/8 subtests	OK · 8/8 subtests	OK · 8/8 subtests
`script-src-strict_dynamic_parser_inserted_module_empty_hash.html`	OK · 1/1 subtests	OK · 0/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_parser_inserted_module.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-strict_dynamic_parser_inserted.html`	OK · 10/10 subtests	OK · 10/10 subtests	OK · 10/10 subtests
`script-src-strict_dynamic_worker-importScripts.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_worker.https.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-trusted_types_eval_DedicatedWorker.html`	OK · 3/3 subtests	Timeout · 1/2 subtests	OK · 3/3 subtests
`script-src-trusted_types_eval_with_report_only_require_trusted_types_eval.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-trusted_types_eval_with_require_trusted_types_eval.html`	OK · 4/4 subtests	OK · 4/4 subtests	Error · 3/4 subtests
`script-src-trusted_types_eval_without_require_trusted_types_eval.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-wildcards-disallowed.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`scripthash-allowed.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-base64url-converts-to-base64.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-basic-blocked-error-event.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-basic-blocked.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-case-insensitive.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-changed-1.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-changed-2.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-default-src.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-ignore-unsafeinline.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-unicode-normalization.sub.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`scriptnonce-allowed.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-and-scripthash.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-basic-blocked.sub.html`	OK · 0/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-changed-1.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-changed-2.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-ignore-unsafeinline.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-redirect.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-specified-source.sub.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`srcdoc-doesnt-bypass-script-src.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`tentative/script-url-allowed-by-hash.https.html`	OK · 4/28 subtests	OK · 4/28 subtests	OK · 6/28 subtests
`tentative/script-url-blocked-report-contains-hash-dedicated-worker.https.html`	OK · 0/1 subtests	Timeout · 0/1 subtests	OK · 0/1 subtests
`tentative/script-url-blocked-report-contains-hash-service-worker.https.html`	Timeout · 0/1 subtests	Timeout · 0/1 subtests	OK · 0/1 subtests
`tentative/script-url-blocked-report-contains-hash-shared-worker.https.html`	OK · 0/1 subtests	Timeout · 0/1 subtests	OK · 0/1 subtests
`tentative/script-url-blocked-report-contains-hash.https.html`	Error · 0/1 subtests	Error · 0/1 subtests	Error · 0/1 subtests
`tentative/url-hash-in-header-and-meta.https.html`	OK · 4/6 subtests	OK · 4/6 subtests	OK · 4/6 subtests
`worker-data-set-timeout.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`worker-eval-blocked.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`worker-function-function-blocked.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`worker-importscripts.sub.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`worker-script-src.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`worker-set-timeout.sub.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests

Pinned API query Test source at the run revision

Source-response fingerprint

SHA-256 4f8181d91982a3086fd0ace7b452d133b5d6293875513de8db5ed1e398b3b1dc

The digest identifies the complete downloaded directory response used for this projection, before file selection. It does not authenticate the runner or prove that the results are truthful.

What this feature can and cannot do

Helps protect against

Injected inline script execution

Does not guarantee

Nonce disclosure or reuse
Unsafe trusted scripts
DOM injection that reaches an allowed sink

What you need before using it

Per-response nonce generation
A CSP script source policy

Fallback to keep in place

Use a carefully scoped CSP and avoid inline script where a nonce deployment cannot be validated.

Browser data used

Not enough specific data

BCD 8.1.5 does not publish a standalone compatibility statement for CSP nonce source expressions.

MDN browser data does not describe this exact feature separately enough for a reliable browser-support calculation.

Specifications

w3c.github.io

Support across major browsers

No exact match

Web Platform Baseline has no exact entry for this browser-data record. ControlCurrent does not substitute a similar feature.

Public browser tests

Relevant tests found

Nonce source parsing and script authorisation behaviour.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

CSP script-srccontent-security-policy/script-srcreviewed test source latest public results

Limit:The mapping covers browser behaviour, not nonce unpredictability, per-response generation, reuse, or disclosure.