{
  "manifest_version": 2,
  "name": "CSP3 control (secured script-src only)",
  "version": "1.0",
  "description": "Control: identical page.html, but the manifest CSP only declares script-src. ExtensionCSPEnforcer strips 'unsafe-inline'/data:/http: from script-src, and with no script-src-elem present Blink falls back to the secured script-src, so all three tests are blocked.",
  "content_security_policy": "script-src 'self' 'unsafe-inline' data: https: http:",
  "background": {
    "scripts": ["background.js"],
    "persistent": true
  },
  "permissions": ["tabs"]
}