Attackers can exploit CSP to block requests to legitimate domains #792

If an attacker executes the following js, it can restrict all request to only polyfil.io:

document.head.insertAdjacentHTML(
  "beforeend",
  `<meta http-equiv="Content-Security-Policy" content="default-src polyfil.io">`,
);

Is there any way to avoid this from happening?