Repro:

1. Launch Chrome with MHTML enabled in Save-Page-As UI by using --save-page-as-mhtml flag (normally it is only enabled on ChromeOS + via extensions + via Offline Pages feature).

2. Open a page that declares CSP directives via <meta> element and embeds one or more child frames from an origin whitelisted via child-src:

  <meta http-equiv="Content-Security-Policy"
        content="img-src 'self'; child-src 'self'">

3. Save the page from previous step as MHTML

4. Open MHTML in Chrome

Expected behavior: MHTML renders in the same way as the original page

Actual behavior: MHTML cannot open child frames:

Refused to frame 'cid:frame-2-A869839A-6287-4C4B-ADDF-AB62C4AF9FBF@mhtml.blink' because it violates the following Content Security Policy directive: "child-src 'self'

(MHTML uses 'cid:' scheme to link to other MHTML parts - see https://tools.ietf.org/html/rfc2557#section-8.3).