Security Bugs in Google Chrome Extensions (And How To Avoid Them) (adrienneporterfelt.com)

It sounds like Google should be more aggressive with default CSPs.