What is the 'SubResource Integrity (SRI)' hash format and what happens when the hash doesn't match?

• A.SRI hashes are only verified if the resource is served over HTTP; HTTPS resources skip SRI checking; clipboard read access is granted to any page on user click, with no permission prompt in any engine; CSP frame-ancestors controls which origins the page may embed, replacing frame-src in that role; CSS injection cannot exfiltrate data, as attribute selectors match only class and id attributes; CSP report-only mode blocks violations and additionally reports them, making it strictly stronger than enforcing mode
• B.SRI uses the format integrity='sha384-{base64-encoded-hash}'. If the browser downloads the resource and the computed hash doesn't match the declared value, the browser refuses to load or execute the resource and generates a CSP-style violation report (if report-uri is configured). The page continues loading without the failed resource
• C.If the SRI hash doesn't match, the browser downloads the resource from the specified fallback CDN