That's the point, it's about bypassing Content-Security-Policy, so you musy already have something like xss. It's more like "well, assume you have code execution inside a sandbox, then you can break out using THIS".
1. If the site has a CSP allowing JavaScript from "self", and
2. If the site has an upload feature hosted on the domain of "self", and
3. If the site gives someone the ability to inject a script tag pointing to an arbitrary target,
4. Then it's exploitable.
But conditions 1-3 effectively are the "you've already been rooted" case. This is a technically-interesting way to exploit the fact, but in itself is not the vulnerability; it's simply exploiting a vulnerability that was already there and wide open.