MetaMask Browser (on Android) does not enforce Content-Security-Policy header

Recently I came across a Cross-Site Scripting bug on the website of a well known crypto company. They had a very strict Content-Security-Policy header, effectively preventing me from achieving anything more then a simple HTML injection with it. That all changed when I opened up the website in …

<!DOCTYPE html>
<html>
<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<meta http-equiv="Content-Security-Policy" content="script-src 'none'">
	<title></title>
</head>
<body>
	CSP enforced with &lt;meta …