<html> <link rel="icon" type="image/png" href="/favicon.png"/> <link rel="icon" type="image/png" href="http://test.com/favicon.png"/> <meta http-equiv="content-security-policy" content="script-src 'self' 'unsafe-inline'" /> <body> <div id="div">Hello World</div> <script type="text/javascript" charset="utf-8"> console.log('a'); document.title = "test" </script> </body> </html>