The main goal of Content Security Policy is to prevent malicious code from being injected into a website and executed within the context of that site.

This could be huge. At the fullest implementation the only JavaScript that will be allowed to execute is external JavaScript files that are specifically white listed by the server. Good bye attribute injection, javascript URIs, and plain SCRIPT tags. No dynamic code execution either! no eval(), no setTimeout() or setInterval() with a string of code. Goodbye obfuscated JavaScript problem. Thanks to native JSON parsing functions, we don't need you anymore.

Some excellent innovation coming out of these Browser wars...