I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser.
A last line of defense for XSS vulnerabilities is a good content security policy header set. It won't get rid of the underlying vulnerability but prevents an attacker from effectively exploiting it. For example, the following policy only loads scripts from the same origin as the webpage:
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-src 'none'; base-uri 'none';
As this is browser-based protection for a web application, I would think it would not mitigate any risk from a universal XSS as it affects the browser and so could bypass the protections. This leaves the only real mitigation for universal XSS as ensuring your browser and plugins are up to date.
Am I correct in my thinking? Appreciate any input.