Alas, many sites have Content-Security Policies, which doesn't block bookmarklets outright, but keeps them from functioning in basic ways: often CSP prevents contact with other sites.

So you can modify the page, yes. But you can't submit content to other domains. You can't load more code. This double-dooms kick-ass awesome extensions like Hypothes.is[1], the brilliant Web Annotation tool/bookmarklet: the bookmarklet can't load the rest of the code needed to launch the experience, and the bookmarklet can't send those annotations the user makes to the user's destination.

I've seen very little interest when issues are raised about doing anything to help Bookmarklets[1]. Browsers seemingly don't care about these users & are fine with Bookmarklets being left to rot away. Meanwhile Chrome on Android still has no other means for users to extend/augment/enhance their own web experience, as Chrome has said repeatedly Extensions will not be supported on mobile, leaving users with nothing.

[1] https://web.hypothes.is/help/installing-the-bookmarklet/

[2] https://github.com/w3c/webappsec-csp/issues/444