Adressing cross-document vectors comprehensively relies on "origin-policy" which is a proposal which is on hold

[mbrodesser-Igalia]

https://w3c.github.io/trusted-types/dist/spec/#cross-document-vectors mentions that.

Examples of instances not addressable appreciated.

[mbrodesser-Igalia]

https://w3c.github.io/webappsec-csp/#security-inherit-csp applies only to local schemes. So non-local schemes are not addressed.

[mbrodesser-Igalia]

https://w3c.github.io/trusted-types/dist/spec/#cross-document-vectors mentions https://github.com/WICG/origin-policy to address cross-document vectors comprehensively. However, the latter is a proposal which is on hold.

[mbrodesser-Igalia]

Are there alternatives?

[koto]

I don't think there are, at least in Web APIs? For TT (or, more generally, CSP) it's a known limitation. Controls are per-document or realm, whereas XSS affects the whole origin.