How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers?
Is it possible to circumvent CSP in order to execute XSS?
Yes, CSP goes a long way to defending against XSS. If you do a Google search on "Content Security Policy XSS" the first few links explain how and why.
If you're having trouble using Google, here are some good links to help explain how CSP defends against XSS:
The CSP policy is enforced by the browser. Therefore, assuming you have set a proper CSP policy, and assuming your browser doesn't have bugs, there is no way to bypass CSP. That's one of the attractions of CSP.
Note that some browsers (e.g., IE10 and earlier versions of IE, if I recall correctly) don't support CSP.
Be warned that CSP is not a silver bullet:
See also A few things beyond the scope of Content Security Policy for more discussion of some problems that CSP doesn't solve.