attacker.example

Creating CSP-blocked iframe to chromewebstore.google.com ...