What the integrity hash actually protects
Every third-party script tag carries a hash of the expected file, so a compromised CDN can't quietly swap the contents. Good — that's exactly the attack it's for.
The team now treats it as covering script injection generally. It doesn't, and the reason is structural: the hash lives in your own markup, so anything that can write your markup can also write the hash.
Boundaries, outermost first: Your document: Your HTML (declares the hash), The script tag (carries the hash) Outside every boundary: Third-party CDN (could be compromised), an empty slot for the required alongside the hash Connections: Your HTML calls The script tag (step 1) The script tag calls required alongside the hash (step 2) required alongside the hash calls Third-party CDN — hash checked here (step 3)