Content-Security-Policy object-src blob

google-chrome blob content-security-policy

The spec compliant answer is object-src 'self' blob:

blob: should only match blob: explicitly, and not 'self' or *. This is a bug in Chrome, and was recently fixed in Firefox 40.

google-chrome blob content-security-policy

For Chrome 47.0.2526.73:

default-src blob:;

worked for me

CodeHunter