An HTTP header that tells the browser where the page may load scripts, styles, images and other content from. It is the main defense against XSS.
A weak point is often the allowing of unsafe-inline (inline scripts), unsafe-eval (running code from text) or the wildcard * for scripts from any domain. Such rules significantly weaken the protection.