2 years ago

#60742

test-img

elunomas

Can chrome extension content scripts load images regardless of host's Content Security Policy?

I have created a Chrome extension with MV3. One of my content scripts pops up an image (a web_accessible_resource) when a user is on two specific sites. The img loads fine on site #1, but not on site #2. If I inspect site #2 in devtools and manually change my img src (to "chrome-extension://file1.png"), the html source code for the img src immediately changes to "unknown". If I repeat this edit and make the img-src to be an image off of the same domain as site #2, the src changes successfully (it does not become "unknown"), which makes me think it must be a CSP-related issue. But there are no errors that I can see, so I cannot confirm this conclusion. Here's my manifest.json:

"web_accessible_resources": [
    {
      "resources": [ "images/myimage.png"],
      "matches": [ "http://*/*","https://*/*" ]
    }
  ],

And the code I use in my content script to create the image and assign the src:

let iconImage = new Image();
                iconImage.className="myImageClass";
                iconImage.src=chrome.runtime.getURL("/images/myimage.png");

This successfully loads the image when my content script runs on Site #1, but not on Site #2. I have also tried loading the image from an external public host, which works fine on Site #1, but not Site #2 (again indicating to me that CSP is the root cause).

Everything I've read about extension resources seems to suggest that web_accessible_resources are exempt from CSP rules, but then what am I missing?

google-chrome

content-security-policy

chrome-extension-manifest-v3

0 Answers

Your Answer

Accepted video resources