I’m trying to develop a Google Chrome extension capable of generating PDF files and showing them to the user. I have a sidePanel defined which makes use of the object tag to attempt to embed the PDF file. The file is served from Google Drive.

<object
  data="https://drive.google.com/file/d/[file_id]/preview"
  type="application/pdf" width="100%" height="500px">
</object>

The problem I’m facing is that Chrome refuses to load the PDF.

side_panel.html:1 Refused to load plugin data from 'https://drive.google.com/file/d/.../preview' because it violates the following Content Security Policy directive: `"object-src 'self'"`.

I tried adding Google Drive’s URL as a valid source to the manifest.json file:

"content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self' https://drive.google.com;"
}

But this results in:

Failed to load extension
File
~/path/to/my_chrome_ext
Error
'content_security_policy.extension_pages': Insecure CSP value "https://drive.google.com" in directive 'object-src'.
Could not load manifest.

Going through the Chrome extension developer docs I found this:

The extension_pages policy cannot be relaxed beyond this minimum value.

The minimum value being this:

"content_security_policy": {
  "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self';"
}

So it seems I’m at a dead end. I’m looking for a way to make this work. Maybe downloading the PDF file as a binary and injecting it as a base64-encoded string.