Violation reporting is configured

Without CSP violation reporting, you have no signal when your extension's security policy is being actively exercised — either by legitimate-but-unexpected resource loads during development, or by an attacker probing injection paths in the wild. NIST SP 800-53 SI-7 (Software, Firmware, and Information Integrity) requires detective controls to surface policy violations. A report-uri or report-to endpoint gives you an event stream of blocked requests, which is the only way to distinguish a misconfigured CSP from an ongoing attack attempt. This is an observability gap, not a direct vulnerability — but the absence of signal means breaches go undetected longer.

Add a report-uri endpoint to your CSP in manifest.json. Any HTTPS endpoint that accepts a POST with Content-Type: application/csp-report will work — services like Report URI or your own logging endpoint.

"content_security_policy": {
  "extension_pages": "script-src 'self'; object-src 'none'; report-uri https://csp.yourdomain.com/report"
}

For modern browsers, prefer report-to with a named reporting group, though report-uri has wider compatibility across extension-hosting surfaces.