Style sources are safe

CWE-693 and OWASP A05 apply: a permissive style-src directive (e.g., style-src * or style-src https:) allows any external stylesheet to be loaded into extension pages. While style injection is less immediately dangerous than script injection, CSS exfiltration attacks exist — attribute selectors can leak sensitive DOM content character by character. More practically, allowing external styles defeats the extension's origin isolation and can be used to fingerprint extension state via timing side-channels. Restricting style-src to 'self' forces style bundling, which also improves offline reliability and eliminates dependency on third-party CDNs.

Restrict style-src to 'self' and bundle all stylesheets locally. If a UI framework requires 'unsafe-inline' for inline styles, that is tolerated but should be paired with a strict script-src.

"content_security_policy": {
  "extension_pages": "style-src 'self'; script-src 'self'; object-src 'none'"
}

Avoid loading fonts or CSS from external CDNs — host them under src/assets/ and reference via relative path.