Source '*' should not match URLs with schemes blob, data, or filesystem as per section Matching Source Expressions of Content Security Policy 2.0 spec. (29 August 2015): [[ 4.2.2. Matching Source Expressions A URL url is said to match a source expression for a protected resource if the following algorithm returns does match: 1. Let url be the result of processing the URL through the URL parser. 2. If the source expression consists of a single U+002A ASTERISK character (*), and url’s scheme is not one of blob, data, filesystem, then return does match. ... ]] <https://w3c.github.io/webappsec-csp/2/#match-source-expression> This is further stressed in section Security Considerations for GUID URL schemes: [[ 4.2.2.1. Security Considerations for GUID URL schemes This section is not normative. As defined above, special URL schemes that refer to specific pieces of unique content, such as "data:", "blob:" and "filesystem:" are excluded from matching a policy of * and must be explicitly listed. ]] <https://w3c.github.io/webappsec-csp/2/#source-list-guid-matching>