Proposal: content_security_policy.content_scripts

[carlosjeurissen]

Since content_scripts run into a different context than the websites. They are not subject to the CSP of the website. To improve security, allow configuring / setting the CSP of content_scripts using content_security_policy.content_scripts. This has been worked on By Mozilla already.

The implementation by Mozilla is not limited to MV3 and is also supposed to work under MV2.

See:
Mozilla Bugzilla issue 1581608
Mozilla discourse discussion
Mozilla announcement

[dotproto]

Chrome originally planned to provide a "content_scripts" field in the "content_security_pollicy", but decided not to for technical reasons. I'm out of the office for a bit, so unfortunately I won't be able to follow up on the details here for a couple weeks.

Since content_scripts run into a different context than the websites. They are not subject to the CSP of the website.

This isn't quite accurate. Content scripts run in an isolated world, but they still (mostly) abide by the host page's CSP. To my knowledge the only notable exception here is that extensions are able to inject resources from their own origins. It's also worth noting that content scripts have been subject to CORB since Chrome 73 and CORS since Chrome 83 (source).