Security Bugs in Google Chrome Extensions (And How To Avoid Them)

It sounds like Google should be more aggressive with default CSPs.