I personally do not see the point of considering this specific issue particularly severe because the Chrome Web Store already allows extensions to execute remote code in extension context simply by declaring `unsafe-eval` or `unsafe-inline` (or specific remote hosts) -- and one can find such extensions quite easily.[1]
If the Chrome Web Store had a policy of "no remote code execution in extension context under any circumstance", then the issue would definitely have been high severity.
* * *
The result back then was that the reported behavior is in accordance with the CSP spec, so the issue was closed.
Maybe Chrome should change their default CSP for extensions that haven't declared one though to disallow blob: URLs.
This is worsened by the fact that the Play Store has near-zero security controls and no review so it's easy for malicious code to sneak into basically any high-install-count extension, especially if (as many extensions do) it requested lots of permissions it doesn't need.
Edit: with chrome extensions, I can inject a script tag from any domain to any page. I used that to inject a lib from CDN JS, but recognized it's silly and imported the package instead.
But I suspect it's related to this:
https://developer.chrome.com/extensions/contentSecurityPolic...
Look at the section named "Evaluated Javascript"
