SRI elements have crossorigin attribute

SRI with the integrity attribute but without crossorigin='anonymous' silently fails in some browsers for cross-origin resources — the integrity check is simply skipped, giving developers a false sense of security while providing zero actual verification. The resource loads without any tamper check. CWE-345 (Insufficient Verification of Data Authenticity) is the direct mapping — the verification mechanism is present but non-functional. CWE-494 applies because the code is downloaded without an effective integrity check. OWASP A08 (Software and Data Integrity Failures) identifies this as a common SRI implementation mistake that neutralizes the protection entirely.

Add crossorigin='anonymous' to every element that has an integrity attribute. These two attributes must always appear together for cross-origin resources.

<!-- WRONG: integrity check silently skipped -->
<script src="https://cdn.example.com/lib.js"
  integrity="sha384-xyz789..."></script>

<!-- CORRECT: both attributes required -->
<script src="https://cdn.example.com/lib.js"
  integrity="sha384-xyz789..."
  crossorigin="anonymous"></script>

Search your codebase for integrity= without crossorigin= on the same element: grep -n 'integrity=' templates/ | grep -v crossorigin. Fix every match — a lone integrity attribute on a cross-origin resource provides no protection.