<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>311728</bug_id>
          
          <creation_ts>2026-04-08 06:41:10 -0700</creation_ts>
          <short_desc>Page CSP blocks content script background image rendering in action popups</short_desc>
          <delta_ts>2026-05-23 07:43:57 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebKit Extensions</component>
          <version>Safari 26</version>
          <rep_platform>Mac (Apple Silicon)</rep_platform>
          <op_sys>macOS 26</op_sys>
          <bug_status>NEW</bug_status>
          <resolution></resolution>
          
          
          <bug_file_loc>https://jeurissen.co/webext-demos/action-popup-content-script-css-data-image</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Carlos J.">carlosj-webkit-bugzilla</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>timothy</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>2197967</commentid>
    <comment_count>0</comment_count>
    <who name="Carlos J.">carlosj-webkit-bugzilla</who>
    <bug_when>2026-04-08 06:41:10 -0700</bug_when>
    <thetext>Given the following:
Extension opens extension popup
The popup has an iframe
The iframe is set to a document which declares a CSP with default-src
The extension applied a css content script to that document with a data:image based background-image

Somehow Webkit does not render this image properly. While other engines render it completely fine.

It seems somehow Webkit interprets the CSP as if it should block the css image.

See demo extension:
http://jeurissen.co/webext-demos/action-popup-content-script-css-data-image</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2197968</commentid>
    <comment_count>1</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2026-04-08 06:41:16 -0700</bug_when>
    <thetext>&lt;rdar://problem/174316860&gt;</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>