How to configure Chart.js for least‑privilege operation in browsers?

Chart.js draws onto an HTML element and often interacts with the page’s DOM and JavaScript runtime. In environments that enforce strict content‑security policies or run the code in sandboxed iframes, granting Chart.js broader privileges than necessary can enlarge the attack surface, especially if malicious scripts attempt to tamper with chart data or canvas operations.

The goal is to restrict Chart.js so it only has the minimal permissions required for rendering and basic interaction, while still functioning correctly. Constraints include a CSP that blocks inline scripts, a sandbox attribute that limits form submission and pop‑ups, and the need to keep the charts responsive.

What configuration options or runtime restrictions can be applied to limit Chart.js to only the capabilities it needs for rendering? Which CSP directives or sandbox attributes align with the principle of least privilege for Chart.js visualizations? How can developers verify that these restrictions do not break chart rendering or interaction?