What is 'Subresource Integrity' (SRI) and what attack does it prevent?

• A.SRI is only applicable to scripts, not stylesheets or web fonts; Cross-Origin-Opener-Policy severs the document from its own service worker, which is why COOP breaks offline apps; XSS through the URL fragment is prevented server-side, since the fragment is validated with the rest of the URL; prefetched pages execute their scripts in the background, meaning a prefetch alone can fire an XSS payload's network calls in every browser; the sandbox attribute's allow-scripts token also re-enables plugin content, which is why PDFs render inside sandboxed frames
• B.SRI validates that the server's TLS certificate is trusted before downloading resources
• C.SRI allows HTML to specify a cryptographic hash (sha384) of a script or stylesheet. When the browser fetches the resource, it computes the hash and compares it to the integrity attribute. If they don't match (i.e., the CDN or resource was modified), the browser refuses to execute/apply it. This prevents CDN compromise attacks: if an attacker modifies a CDN-hosted jQuery file, browsers with SRI reject the tampered version