I tried it with a clean download of firefox so no plugins there and it didn't work. I've disabled Windows Defender and it also didn't work. Here is the full copy of the console log from just now. Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' https://*.googlesyndication.com https://*.doubleclick.net <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a>". Either the 'unsafe-inline' keyword, a hash ('sha256-m8iOPIhA29muXStlj097KZXdLfw6Fho5U54aBGRS7xE='), or a nonce ('nonce-...') is required to enable inline execution. app.roll20.net/:13 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' https://*.googlesyndication.com https://*.doubleclick.net <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a>". Either the 'unsafe-inline' keyword, a hash ('sha256-k8Kx+oSRaLZ+X7/r67j0Mow6bzS2pemyX++9YAOg3BU='), or a nonce ('nonce-...') is required to enable inline execution. app.roll20.net/:1 The SSL certificate used to load resources from <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See <a href="https://g.co/chrome/symantecpkicerts" rel="nofollow">https://g.co/chrome/symantecpkicerts</a> for more information. app.js?1518541262:84 70 app.js?1518541262:85 TOUCH SUPPORTED: false app.js?1518541262:85 USING WEBGL ACCELERATION... app.js?1518541262:85 WEBGL STARTUP SUCCESS app.js?1518541262:86 Custom Sheet Translation app.js?1518541262:79 select app.js?1518541262:79 Switch mode to select app.js?1518541262:96 Initializing new dice engine with randomness... app.js?1518541262:96 Using random entropy app.js?1518541262:99 Compiling sheet... app.js?1518541262:99 Found rolltemplate: simple app.js?1518541262:99 Found rolltemplate: atk app.js?1518541262:99 Found rolltemplate: dmg app.js?1518541262:99 Found rolltemplate: atkdmg app.js?1518541262:99 Found rolltemplate: desc app.js?1518541262:99 Found rolltemplate: spell app.js?1518541262:99 Found rolltemplate: traits app.js?1518541262:99 Found rolltemplate: npc app.js?1518541262:99 Found rolltemplate: npcatk app.js?1518541262:99 Found rolltemplate: npcdmg app.js?1518541262:99 Found rolltemplate: npcaction app.js?1518541262:99 Found webworker script app.js?1518541262:99 Finding sheet rolls... app.js?1518541262:100 window resize app.js?1518541262:85 Final set zoom! app.js?1518541262:85 UPDATE GL SIZE! app.js?1518541262:85 Final set zoom! tutorial_tips.js:7 tuts loaded 11Mixed Content: The page at '<URL>' was loaded over HTTPS, but requested an insecure image '<URL>'. This content should also be served over HTTPS. app.js?1518541262:94 MESSAGE RECEIVED app.js?1518541262:94 MessageEvent sheetsandboxworker.js?20170926:260 Starting up WEB WORKER /js/d20/sheetsandboxworker.js?20170926:260 Starting up WEB WORKER app.js?1518541262:91 Final page load. app.js?1518541262:101 Refresh jukebox List! app.js?1518541262:91 Auth'ed. app.js?1518541262:91 Go post auth! app.js?1518541262:91 initial setup app.js?1518541262:101 Refresh jukebox List! app.js?1518541262:91 Heard playingplaylist change to -L53JVVgZCweA-LnVcBi app.js?1518541262:101 Refresh jukebox List! app.js?1518541262:89 T.s app.js?1518541262:94 refershing page listings! app.js?1518541262:91 Scan for new plays! app.js?1518541262:91 Got players value... app.js?1518541262:91 joining game... app.js?1518541262:89 Global Volume: 100=1 app.js?1518541262:89 Player -L5-8-e7q3fLyg8GxmNg is offline... app.js?1518541262:89 Player -L5-EPJvOWEXVKx9zUkz is offline... app.js?1518541262:89 Player -L5-OV4jL2ZF94KWqH_S is offline... app.js?1518541262:89 Player -L54_9aEc3iUmcmhI0h4 is offline... app.js?1518541262:91 Deferred finish joining... app.js?1518541262:84 Firebase Online app.js?1518541262:98 Refresh Journal List! app.js?1518541262:98 Search took 14ms 3app.js?1518541262:88 Full load page! app.js?1518541262:91 We have 15 pages app.js?1518541262:91 handle page changes app.js?1518541262:91 false app.js?1518541262:91 Scan for new plays! app.js?1518541262:87 Do refresh link cache! app.js?1518541262:94 refershing page listings! app.js?1518541262:91 init active page! app.js?1518541262:88 activate page! app.js?1518541262:88 FULLY ACTIVATE VIEWS FOR PAGE. app.js?1518541262:98 Refresh Journal List! app.js?1518541262:98 Search took 30ms app.js?1518541262:101 Refresh jukebox List! app.js?1518541262:88 Graphics: 2 app.js?1518541262:88 Paths: 3 app.js?1518541262:94 refershing page listings! app.js?1518541262:88 Reorder by ZORDER app.js?1518541262:92 Show Character View Dialog! app.js?1518541262:92 --- RENDER CHARACTIVE VIEW ---- app.js?1518541262:92 Redoing charsheet html app.js?1518541262:92 68ms to end of html app.js?1518541262:87 289 sheetsandboxworker.js?20170926:67 Triggering for sheet:opened /js/d20/sheetsandboxworker.js?20170926:67 Triggering for sheet:opened VM19:3550 5th Edition OGL by Roll20 v2.1 (unknown) 5th Edition OGL by Roll20 v2.1 app.js?1518541262:92 Really updating character sheet values app.js?1518541262:92 Setting up repeating sections took until 15ms app.js?1518541262:92 Updating ALL VALUES app.js?1518541262:92 Finding list of dirty attributes took until 16ms app.js?1518541262:92 Querytest took until 17ms app.js?1518541262:92 Attribute cache compliation took until 17ms app.js?1518541262:92 Set values (including auto-calcuating variables) took until 38ms app.js?1518541262:92 Appending to screen took until 52ms app.js?1518541262:92 Took 56ms app.js?1518541262:88 Swapping <a href="https://s3.amazonaws.com/files.d20.io/images/33087143/LTkRyEZep9RHUV4vU93xwA/thumb.jpg?14949417825" rel="nofollow">https://s3.amazonaws.com/files.d20.io/images/33087143/LTkRyEZep9RHUV4vU93xwA/thumb.jpg?14949417825</a> to <a href="https://s3.amazonaws.com/files.d20.io/images/33087143/LTkRyEZep9RHUV4vU93xwA/max.jpg?14949417825" rel="nofollow">https://s3.amazonaws.com/files.d20.io/images/33087143/LTkRyEZep9RHUV4vU93xwA/max.jpg?14949417825</a> 2app.js?1518541262:88 Reorder by ZORDER 2app.js?1518541262:100 Body drop! app.js?1518541262:92 Compendium item dropped onto target! app.js?1518541262:100 Drop handled, returning... app.js?1518541262:92 <a href="https://app.roll20.net/compendium/dnd5e/Spells%3AEldritch%20Blast.json?plaintext=true" rel="nofollow">https://app.roll20.net/compendium/dnd5e/Spells%3AEldritch%20Blast.json?plaintext=true</a> app.js?1518541262:100 window resize app.js?1518541262:85 Final set zoom! app.js?1518541262:85 UPDATE GL SIZE! app.js?1518541262:85 Final set zoom! app.js?1518541262:88 setting src app.js?1518541262:83 Cols: 2 Rows: 1 app.js?1518541262:83 Took 2ms to generate cache.