A web tool experiment demonstrating how to handle Content Security Policy errors in sandboxed iframes by intercepting fetch requests and prompting users to whitelist domains. The tool was built using GPT-5.5 via the Codex desktop app.
# Tool: CSP Allow-list Experiment
Source: [https://simonwillison.net/2026/May/13/csp-allow/](https://simonwillison.net/2026/May/13/csp-allow/)
13th May 2026
Tool[CSP Allow\-list Experiment](https://tools.simonwillison.net/csp-allow)
An experiment that shows that you can load an app in a CSP\-protected sandboxed iframe \(see[previous note](https://simonwillison.net/2026/Apr/3/test-csp-iframe-escape/)\) and have a custom`fetch\(\)`that intercepts CSP errors and passes them up to the parent window\.\.\. which can then prompt the user to add that domain to an allow\-list and then refresh the page\.
I built this one with GPT\-5\.5 xhigh running in the Codex desktop app\.
Posted[13th May 2026](https://simonwillison.net/2026/May/13/)at 4:50 am
This article explores options for replacing the deprecated uMatrix browser extension under Chrome's Manifest V3, proposing a solution using declarativeNetRequest and Content Security Policy to control site permissions and subresource requests.
The article discusses the TC39 ShadowRealm proposal, which aims to allow JavaScript execution in isolated environments (realms) without using iframes or web workers, improving code sandboxing and performance.