<script>...</script> embedded directly in the HTML.
<script src="first-party.js"> loaded from the same origin.
<script src="cdn..."> loaded from an external domain.
<iframe src="youtube.com/..."> blocked by frame-src 'none'.
<object data="test.svg"> blocked by object-src 'none'.
Orange SVG = script ran inside it.
<embed src="test.svg"> blocked by object-src 'none'.