Some more shadiness from this company. The Zoom.us-website is explicitly allowing the browser with its content security policy-headers to load scripts from these domains:
I saw somewhere on Twitter, possibly as a reply to Scott Helme, that they possibly added these URLs to their CSP because they were getting errors in their CSP logs from machines that had adware/malware loaded. Can't find the tweet though, so maybe it wasn't him (but I'm reasonably sure it was a discussion of CSP, ReportURI, and the fact the CSP changes depending on logged in/out of zoom's site).
Its amazing how many Zoom screenshots have spelling or grammar errors, like this one. For a supposedly US based company, its pretty clear a lot of the UI text isn't written by a native English speaker.
I'm not intedning to demean non-native English speakers or their ability to write code - but this looks pretty bad from a QA standpoint.
edit: elsewhere in the thread its shown most of the software engineering team is in China, which explains this.
Having worked with CSP this isn't really something that can be fixed. If you disable scripts from all but approved sources your reporting URI will be flooded with reports from browser extensions and malware trying to inject code. The best you can do is silence the reports after they arrive (or in this case just allow them, yuck).
https://*.50million.club
https://apiurl.org
https://secure.myshopcouponmac.com
https://serve2.cheqzone.com
https://ad.lkqd.net
Doing a fast google for these domains shows they are mostly known for being associated with malware...