Repros in Chrome 57 and Firefox 53.

Mike, could you please take a look?

We gate navigation to `javascript:` (both via `<iframe>`/`<frame>` and via `<a>`) on `script-src`, as the code execution happens in the current document (see https://w3c.github.io/webappsec-csp/#script-src-inline in CSP, which is called from https://w3c.github.io/webappsec-csp/#should-block-navigation-request, which is called from HTML's navigation algorithm in step ~12 of https://html.spec.whatwg.org/#navigate; it's convoluted, but I think it's accurate).

I can see how you might expect `child-src` to gate these kinds of executions, but that's not the route we've taken in CSP. If you'd like to spark a deeper discussion about whether we're doing the right thing, I'd suggest filing a bug against the spec at https://github.com/w3c/webappsec-csp/issues/. Happy to chat about things there.

@mike thanks a lot for clarifications.
I probably got confused by the presence of 'unsafe-inline' in the documentation (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src). 
BTW hasn't this already discussed in https://github.com/w3c/webappsec-csp/issues/127 ?

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot