NEVER use untrusted bookmarklet! In Firefox bookmarklets are executed as author's script. But should be executed as user's scripts (with higher pivileges). This why it's impossible to execute bookmarklets on website that use a strict CSP. This extension execute bookmarklets as content script (privileged context). This allow to make cross-origin requests, write to the clipboard, communicate with addons, etc. Note: CSP still applied on subresources (dependencies). That means with a super strict CSP "none", you can't use other scripts, styles nor medias More informations on Github page