Site in question are solely relying on the deprecated `child-src` directive.
Deprecation in CSP-3: https://w3c.github.io/webappsec-csp/#directive-child-src
Important: This is a rather course temporary workaround and should be removed when the standard stabilizes or a more accurate solution is found.
The main reason for this workaround is that sites remove sources from the `script-src`/`default-src` list for workers, expecting it to be handled solely by `child-src`.
Tag #949
Pale Moon
Moonchild