[CRITICAL] Gemini Web UI code renderer crashes mid-stream due to missing CSP directive (*.static.usercontent.goog)

Gemini API
1

Hi Gemini Web & Infrastructure Team,

I am reporting a critical frontend issue where the web UI renderer crashes mid-response whenever the model generates code blocks (JSX/TSX, React components, template literals, or standard web syntax).

Symptoms

  • The output streams normally until it reaches a JSX tag or code block hydration point (e.g., right at return ( or <div).

  • At that exact moment, the code block fails to render, spilling raw text into the main DOM layout.

  • UI elements (copy buttons, feedback thumbs, syntax highlighting) completely break or freeze.

Root Cause & Console Diagnostic

Inspecting the Chrome Developer Console reveals that this is not a model or Markdown parser bug, but a Content Security Policy (CSP) misconfiguration on the backend.

The server handling my session sends a Content-Security-Policy HTTP header that omits https://*.static.usercontent.goog from its script-src directive. When the frontend attempts to dynamically import code block hydration modules, Chrome blocks them.

Console Logs:

Refused to load the script '[https://njl0.static.usercontent.goog/boq-bard-web/islands/assets/island-bootstrap-runtime-*.js](https://njl0.static.usercontent.goog/boq-bard-web/islands/assets/island-bootstrap-runtime-*.js)' 
because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' blob: data: [https://www.gstatic.com](https://www.gstatic.com) ... [missing *.static.usercontent.goog]"

Verification & Key Findings

  1. Staged Rollout Issue: A secondary paid account under the exact same Google Workspace enterprise domain works perfectly. It hits a different backend cluster whose CSP response header explicitly includes https://*.static.usercontent.goog.

  2. Client-Side Unfixable: Chrome’s Manifest V3 security policy strictly enforces CSP on primary Google domains at the network level, preventing local browser extensions or header-modifying tools from overriding it.

Requested Action

Could the frontend/infrastructure team please update the Content-Security-Policy header configuration across all active production and staged rollout backend clusters for Gemini Web?

Thank you!

2

Update: Root Cause Identified — Outdated CSP Header Blocking *.static.usercontent.goog

I have identified the exact technical root cause after inspecting the browser Developer Console when the code block rendering crashes.

Diagnostic & Root Cause

The backend server assigned to my account cluster is sending an outdated Content Security Policy (CSP) HTTP response header that omits *.static.usercontent.goog from its allowed script-src directive.

Console Error Logs

Plaintext

Refused to load the script 'https://njl0.static.usercontent.goog/boq-bard-web/islands/assets/island-bootstrap-runtime-*.js' 
because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.gstatic.com ... [omitting *.static.usercontent.goog]"

Failure Cascade Impact

  1. Code Block Hydration Failure: When the response streams JSX/TSX or backtick template literals, the frontend attempts to dynamically import interactive UI scripts (island-bootstrap-runtime-*.js, islands-*.js).

  2. Execution Halt: Chrome enforces the CSP and blocks the scripts from loading.

  3. UI Crash: The Markdown code block fails to mount/hydrate, cutting off mid-stream (typically right at return ( or raw < tags), spilling unescaped raw text, and breaking the DOM layout.

  4. Broken UI Elements: Secondary web components relying on these dynamic scripts (such as the feedback 👎 modal) also fail silently.

Additional Observations

  • Staged Rollout Issue: Another paid account under the exact same Google Workspace enterprise domain works perfectly because it hits a different backend cluster serving updated CSP headers that explicitly include https://*.static.usercontent.goog.

  • Client-Side Unfixable: Chrome’s Manifest V3 security model prevents client-side extensions from overriding CSP headers on main Google domains, meaning this requires a backend fix.

Could the Web UI / Frontend infrastructure team please check the CSP configuration across all active staged rollout clusters for Gemini Web?

Thanks!