Simon Willison presented an experiment demonstrating how an application within a CSP-protected sandboxed iframe can intercept CSP errors using a custom `fetch()` function. This allows the parent window to prompt users to add domains to an allow-list, improving security with dynamic user interaction.
Source: Simon Willison