VULNERABILITY DETAILS
Inline script elements located at the very top of a HTML page, before the HTML start tag, are executed even if the user has explicitly blocked non-whitelisted scripts in a Content-Security-Policy meta tag in the head section.
Even if it's a very bad thing (!) to implement Content-Security-Policy in meta tags, some users may still trust http-equiv meta tags to work the same way as if the directives was given in the server header.

Generally, there should be some option to block scripts that are appended or prepended completely outside the DOM. This 'feature' effectively breaks additional security measures such as PGP signing of the HTML source to preserve the integrity of high-security static HTML pages. Malicious scripts that are injected outside the signed block can alter the displayed page content without actually breaking the PGP signature.

VERSION
Chrome Version: 50.0.2661.102 (64-bit)
Operating System: OS X El Capitan, 10.11.3 (15D21)

REPRODUCTION CASE
See attached HTML file. I expected only the second script element to execute, but the first test script at the top of the page are run as well. The third script element at the bottom is blocked as one would expect.
 

Deleted: test.html 1.1 KB

test.html 1.1 KB View Download