My current theory is that setting document.documentElement.innerHTML does not trigger nsDocument::StartDocumentLoad, so CSP is not being set on the document. I am investigating this now and will post here when I have results.