Image is blocked as expected in Firefox and Edge.

Image is not blocked in Chrome 63 to 66 ToT and Safari Stable/TP.
https://whytls.com/test/CSPObjectSrcNone.php

The image request enters ContentSecurityPolicy::AllowRequest with a context of 
WebURLRequest::kRequestContextImage, so the object-src policy isn't evaluated. This appears to be a violation of CSP2 and CSP3, which note: 

"Note: The object-src directive acts upon any request made on behalf of an object, embed, or applet element. This includes requests which would populate the nested browsing context generated by the former two (also including navigations). This is true even when the data is semantically equivalent to content which would otherwise be restricted by another directive, such as an object element with a text/html MIME type."

Our handling of the OBJECT element has a special case for images, whereby it creates a HTMLImageLoader when it sees that the URL has an image-like file extension.

https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/html/HTMLObjectElement.cpp?l=117&rcl=12595c3ca47ceab49c86914d409375fe60fa4e94

Would this be reasonable? It seems to fix the issue, but perhaps there's some other dire outcome of changing the context like this:

--- a/third_party/WebKit/Source/core/loader/ImageLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/ImageLoader.cpp
@@ -391,6 +391,10 @@ void ImageLoader::DoUpdateFromElement(BypassMainWorldBehavior bypass_behavior,
           referrer_policy, url, document.OutgoingReferrer()));
     }

+    if (IsHTMLObjectElement(GetElement()))
+      resource_request.SetRequestContext(
+          WebURLRequest::kRequestContextObject);
+

you can also load svg file like this : `<object data="1.svg" type="image/jpeg"></object>`
so i think it would be medium severity

Re #7, when you load the SVG that way, does it execute script, or is it equivalent to doing <img src="something.svg" />

seems like just equivalent to <img src='xxx.svg'

Let's see what breaks: https://chromium-review.googlesource.com/c/chromium/src/+/924589

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e56aee6473486fdfac0429747284fda7cdd3aae5

commit e56aee6473486fdfac0429747284fda7cdd3aae5
Author: Eric Lawrence <elawrence@chromium.org>
Date: Tue Feb 20 19:21:03 2018

Use correct Request Context when EMBED or OBJECT requests an image

When an OBJECT or EMBED element requests an image, it does so using
an ImageLoader. To ensure that Content-Security-Policy restrictions
are applied correctly in this scenario, we must adjust the request's
context to indicate the originating element.

Bug:  811691 
Change-Id: I0fd8010970a12e68e845a54310695acc0b3f7625
Reviewed-on: https://chromium-review.googlesource.com/924589
Commit-Queue: Eric Lawrence <elawrence@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#537846}
[add] https://crrev.com/e56aee6473486fdfac0429747284fda7cdd3aae5/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/embed-src-image-url-blocked-expected.txt
[add] https://crrev.com/e56aee6473486fdfac0429747284fda7cdd3aae5/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/embed-src-image-url-blocked.html
[add] https://crrev.com/e56aee6473486fdfac0429747284fda7cdd3aae5/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-image-url-blocked-expected.txt
[add] https://crrev.com/e56aee6473486fdfac0429747284fda7cdd3aae5/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-image-url-blocked.html
[modify] https://crrev.com/e56aee6473486fdfac0429747284fda7cdd3aae5/third_party/WebKit/Source/core/loader/ImageLoader.cpp

Will this bug displayed in M65 release notes?

The fix for this issue will ship in M66. 

I'm afraid the VRP panel declined to reward for this bug, sorry :-(  Many thanks for the report though!

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot