Background

Currently no good documentation is present on what the default content_security_policy is for every context (extension_pages, content_scripts and sandbox). This is a must when composing a custom CSP, especially when default-src is not set.

Firefox documentation gives:
script-src 'self'; object-src 'self';
See: MDN Docs

Chrome documentation gives:
default-src 'self'; connect-src * data: blob: filesystem:; style-src 'self' data: 'unsafe-inline'; img-src 'self' data:; frame-src 'self' data:; font-src 'self' data:; media-src * data: blob: filesystem:;
See: Chrome Docs. However, this seems to only apply to the legacy Chrome Apps.

Also no info is present on what the default is in MV3 or if it differs from MV2.

Action items

• Have an overview of each default CSP in each context for each browser and manifest_version
• Streamline the default CSP across browsers

Proposals

1. To best showcase what an extension does, how it's permissions are used and to decrease the attack surface with security vulnerabilities, requiring default-src in custom CSP could be proposed.
2. Have a default CSP (either as replacement or in addition to the above default) which won't be overridden by the extension custom CSP which will function next to the custom CSP. This could make restrictions more understandable / technically implementable.

See also:

• Inconsistency: custom content_security_policy browser restrictions #99