NOTE: if you’re looking for the popup animate bug issue 813371 see this repo.

Tested with:

• Chrome 64.0.3282
• Mac OS X 10.13.2

Running the following extension on a page that loads with the response header of Content-Security-Policy: "sandbox ;" (e.g., this page) fails to trigger the callback between step 3 ("chrome.tabs.sendMessage(..., test)") and step 4 ("chrome.tabs.sendMessage callback!").

In page.js in the onMessage(...) function, if the callback is called inside a setTimeout then this fails silently. If the setTimeout is removed, then this works fine.

I would expect either (1) adding the content script doesn't work at all or (2) calling the callback inside a setTimeout would work just like the rest of the code.

Separately, despite no scripts being on the page, the error console on the page with CSP sandbox is constantly printing the following error message:

Blocked script execution in '<URL>' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.