The `fetch` function incorrectly verifies Subresource Integrity (SRI) metadata by splitting the integrity string only on single spaces. Because the SRI grammar allows any ASCII whitespace, including horizontal tabs, any digest preceded by such whitespace is treated as an unrecognized token and skipped. If no recognized algorithms remain, the integrity list is treated as empty, allowing a server to return a response body that differs from the pinned digest without triggering an integrity error. This allows an attacker who controls the response body to deliver malicious bytes to an application using whitespace-surrounded SRI values.