WordPress 7 custom HTML broken

Since updating to from WordPress 6.9 to 7, custom HTML blocks display a gray box in the editor with

“This content is blocked. Contact the site owner to fix the issue.”

looking at the console

Framing ‘blob:https://website/a8a38226-fe28-49c9-8a6c-68e1dd5780e4’ violates the following Content Security Policy directive: “default-src ‘self’ https: data:”. The request has been blocked. Note that ‘frame-src’ was not explicitly set, so ‘default-src’ is used as a fallback.

block-editor.min.js?ver=93c3566b7f24c15b7e17:76 Uncaught TypeError: Cannot destructure property ‘documentElement’ of ‘z’ as it is null.
at HTMLIFrameElement.j (block-editor.min.js?ver=93c3566b7f24c15b7e17:76:960)

there are also warnings leading to

https://developer.ww.wp.xz.cn/block-editor/reference-guides/block-api/block-api-versions/block-migration-for-iframe-editor-compatibility/

but what this means is above my paygrade