CSP strict-dynamic · ControlCurrent

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

Browser	Minimum	Outcome	Reason
Chrome	155	Works	Every required mapped BCD feature is available without a recorded qualification.
Edge	154	Works	Every required mapped BCD feature is available without a recorded qualification.
Firefox	157	Works	Every required mapped BCD feature is available without a recorded qualification.
Safari	27	Works	Every required mapped BCD feature is available without a recorded qualification.
Chrome for Android	155	Works	Every required mapped BCD feature is available without a recorded qualification.
Firefox for Android	157	Works	Every required mapped BCD feature is available without a recorded qualification.
Safari on iOS	27	Works	Every required mapped BCD feature is available without a recorded qualification.
Android WebView	155	Works	Every required mapped BCD feature is available without a recorded qualification.
Samsung Internet	30.0	Works	Every required mapped BCD feature is available without a recorded qualification.

The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.Content-Security-Policy.strict-dynamic

1 – 5151 recorded releases
Not supported
52 – 155103 recorded releases
Works

Edge

http.headers.Content-Security-Policy.strict-dynamic

12 – 187 recorded releases
Not supported
79 – 15475 recorded releases
Works

Firefox

http.headers.Content-Security-Policy.strict-dynamic

1 – 5154 recorded releases
Not supported
52 – 157106 recorded releases
Works

Safari

http.headers.Content-Security-Policy.strict-dynamic

1 – 15.329 recorded releases
Not supported
15.4 – 2732 recorded releases
Works

Chrome for Android

http.headers.Content-Security-Policy.strict-dynamic

18 – 5128 recorded releases
Not supported
52 – 155103 recorded releases
Works

Firefox for Android

http.headers.Content-Security-Policy.strict-dynamic

4 – 5145 recorded releases
Not supported
52 – 15796 recorded releases
Works

Safari on iOS

http.headers.Content-Security-Policy.strict-dynamic

1 – 15.326 recorded releases
Not supported
15.4 – 2732 recorded releases
Works

Android WebView

http.headers.Content-Security-Policy.strict-dynamic

1 – 5123 recorded releases
Not supported
52 – 155103 recorded releases
Works

Samsung Internet

http.headers.Content-Security-Policy.strict-dynamic

1.0 – 5.412 recorded releases
Not supported
6.0 – 30.040 recorded releases
Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

A fixed result snapshot

What those browser runs reported

Reviewed 11 October 2026

These are published results from specific stable-labelled browser builds. They are separate from the compatibility calculation and from evidence about your application. File outcomes and subtest counts stay separate. OK describes a completed harness, which can still contain failing subtests; Pass and Fail can also describe tests without a harness.

Exact browser builds, systems and source revision

firefox 157.0 · linux 22.04 · stable
Run 4877098740350976 · 2026-10-06T10:36:34.451Z to 2026-10-06T11:50:28.028Z
cc74d2669f5de548e808779877d1d33339ec5115
safari 27.0 (22625.1.29.11.27) · mac 27.0 · stable
Run 5164107446878208 · 2026-10-06T06:14:03.64Z to 2026-10-06T09:13:55.471Z
cc74d2669f5de548e808779877d1d33339ec5115
chrome 154.0.8037.92 · linux 22.04 · stable
Run 6218298311311360 · 2026-10-06T07:44:01.102Z to 2026-10-06T11:57:16.569Z
cc74d2669f5de548e808779877d1d33339ec5115

“Stable” is the upstream run label. Complete runtime flags were not supplied by the summary API. These results do not cover every browser version, mobile platform or operating system.

CSP script-src

content-security-policy/script-src

90 test files retained from 90 returned search matches. Only this exact directory prefix is included. This is the returned result inventory, not a claim that every possible suite test ran.

Browser build	Subtests passed / reported	File outcomes
firefox 157.0	182 / 214	88 OK · 1 Error · 1 Timeout
safari 27.0 (22625.1.29.11.27)	177 / 213	85 OK · 1 Error · 4 Timeout
chrome 154.0.8037.92	185 / 214	88 OK · 2 Error

Read all 90 retained file results

Test file	firefox	safari	chrome
`audioworklet-eval-blocked.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`audioworklet-trusted-types-eval-blocked.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`eval-allowed-in-report-only-mode-and-sends-report.html`	OK · 2/2 subtests	OK · 1/2 subtests	OK · 2/2 subtests
`eval-allowed-in-report-only-mode.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/iso-8859-1.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/iso-8859-3.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/iso-8859-7.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/iso-8859-9.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/utf-8-lone-surrogate.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`hash-always-converted-to-utf-8/utf-8.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`injected-inline-script-allowed.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`injected-inline-script-blocked.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`javascript-window-open-blocked.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`non-nonceable-elements.html`	OK · 10/10 subtests	OK · 7/10 subtests	OK · 10/10 subtests
`nonce-enforce-blocked.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`nonce-with-trailing-characters-blocked.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-1_1.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-1_10_1.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_10.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_2_1.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_2.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-1_3.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_4_1.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-1_4_2.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-1_4.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-event-handler-on-inline-script.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-multiple-policies-multiple-hashing-algorithms.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-multiple-policies-one-using-hashing-algorithms.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-overrides-default-src.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-report-only-policy-works-with-external-hash-policy.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-report-only-policy-works-with-hash-policy.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-sri_hash.sub.html`	OK · 12/12 subtests	OK · 12/12 subtests	OK · 12/12 subtests
`script-src-strict_dynamic_and_unsafe_eval_eval.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_and_unsafe_eval_new_function.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_discard_source_expressions.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_double_policy_different_nonce.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-strict_dynamic_double_policy_honor_source_expressions.sub.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-strict_dynamic_double_policy_report_only.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_eval.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_hashes.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-strict_dynamic_in_img-src.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_javascript_uri.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_meta_tag.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-strict_dynamic_modulepreload_parser_inserted_module.html`	OK · 2/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-strict_dynamic_new_function.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_non_parser_inserted_incorrect_nonce.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_non_parser_inserted_module.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`script-src-strict_dynamic_non_parser_inserted.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-strict_dynamic_parser_inserted_correct_nonce.html`	OK · 8/8 subtests	OK · 8/8 subtests	OK · 8/8 subtests
`script-src-strict_dynamic_parser_inserted_module_empty_hash.html`	OK · 1/1 subtests	OK · 0/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_parser_inserted_module.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-strict_dynamic_parser_inserted.html`	OK · 10/10 subtests	OK · 10/10 subtests	OK · 10/10 subtests
`script-src-strict_dynamic_worker-importScripts.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`script-src-strict_dynamic_worker.https.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`script-src-trusted_types_eval_DedicatedWorker.html`	OK · 3/3 subtests	Timeout · 1/2 subtests	OK · 3/3 subtests
`script-src-trusted_types_eval_with_report_only_require_trusted_types_eval.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-trusted_types_eval_with_require_trusted_types_eval.html`	OK · 4/4 subtests	OK · 4/4 subtests	Error · 3/4 subtests
`script-src-trusted_types_eval_without_require_trusted_types_eval.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`script-src-wildcards-disallowed.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`scripthash-allowed.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-base64url-converts-to-base64.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-basic-blocked-error-event.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-basic-blocked.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-case-insensitive.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-changed-1.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-changed-2.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-default-src.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-ignore-unsafeinline.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scripthash-unicode-normalization.sub.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`scriptnonce-allowed.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-and-scripthash.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-basic-blocked.sub.html`	OK · 0/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-changed-1.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-changed-2.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-ignore-unsafeinline.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-redirect.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`scriptnonce-specified-source.sub.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`srcdoc-doesnt-bypass-script-src.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`tentative/script-url-allowed-by-hash.https.html`	OK · 4/28 subtests	OK · 4/28 subtests	OK · 6/28 subtests
`tentative/script-url-blocked-report-contains-hash-dedicated-worker.https.html`	OK · 0/1 subtests	Timeout · 0/1 subtests	OK · 0/1 subtests
`tentative/script-url-blocked-report-contains-hash-service-worker.https.html`	Timeout · 0/1 subtests	Timeout · 0/1 subtests	OK · 0/1 subtests
`tentative/script-url-blocked-report-contains-hash-shared-worker.https.html`	OK · 0/1 subtests	Timeout · 0/1 subtests	OK · 0/1 subtests
`tentative/script-url-blocked-report-contains-hash.https.html`	Error · 0/1 subtests	Error · 0/1 subtests	Error · 0/1 subtests
`tentative/url-hash-in-header-and-meta.https.html`	OK · 4/6 subtests	OK · 4/6 subtests	OK · 4/6 subtests
`worker-data-set-timeout.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`worker-eval-blocked.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`worker-function-function-blocked.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`worker-importscripts.sub.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`worker-script-src.sub.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`worker-set-timeout.sub.html`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests

Pinned API query Test source at the run revision

Source-response fingerprint

SHA-256 4f8181d91982a3086fd0ace7b452d133b5d6293875513de8db5ed1e398b3b1dc

The digest identifies the complete downloaded directory response used for this projection, before file selection. It does not authenticate the runner or prove that the results are truthful.

What this feature can and cannot do

Helps protect against

Brittle host allowlists
Script injection through allowed origins

Does not guarantee

Compromise of an authorised script
Unsafe script loaders
Browsers that ignore the source expression

What you need before using it

CSP nonces or hashes
A tested fallback source list

Fallback to keep in place

Retain compatible host and scheme sources for browsers that do not implement strict-dynamic.

Browser data used

Support can be calculated

http.headers.Content-Security-Policy.strict-dynamic

Specifications

w3c.github.io

Support across major browsers

Adoption information available

Web Platform Baseline indicates when a feature became available across major browsers. It does not inspect your website or replace the browser-by-browser result.

Content Security Policy (CSP)

http.headers.Content-Security-Policy.strict-dynamic

Status: widely available · low 2022-03-14 · high 2024-09-14

Public browser tests

Relevant tests found

strict-dynamic parsing, trust propagation, and fallback interactions.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

CSP script-srccontent-security-policy/script-srcreviewed test source latest public results

Limit:Passing behaviour does not establish that an application's trusted loaders are safe.