VULNERABILITY DETAILS

VERSION
Chrome Version: 51.0.2704.84 (Official Build) (64-bit)
Operating System: Mac OS X 10_11_5

DESCRIPTION
Any extension can modify or completely remove Content-Security-Policy header specified by a web site by using chrome.webRequest API

WHY IT IS BAD
First, it violates W3C recommendation https://www.w3.org/TR/CSP2/#security-considerations "The Content-Security-Policy header ... SHOULD NOT be modified or removed by proxies or other intermediaries not in the same administrative domain as the resource."
Second, Content-Security-Policy is designed to let site owners take control over what code is executed on the client side. 
Ad injectors and malicious extensions are a big problem. Google estimates 5.5% users have ad injectors. 
Content-Security-Policy could be a perfect instrument to stop malicious extensions by limiting script-src and blocking injected scripts. However, this approach can be easily bypassed in Chrome.

PROPOSED SOLUTION
Have a blacklist of critical headers (including Content-Security-Policy and Content-Security-Policy-Report-Only) that extensions cannot access thru webRequest API.
If a web app wants to allow some particular extension, it can explicitly state this in its policy, e.g. Content-Security-Policy: default-src chrome-extension://someid

PROOF OF CONCEPT
The following code will remove CSP header from all responses

chrome.webRequest.onHeadersReceived.addListener(function(details){
	var newResponseHeaders = [];
	for (var i = 0; i < details.responseHeaders.length; i++) {
		var isCSPHeader = /content-security-policy/i.test(details.responseHeaders[i].name);
		if (!isCSPHeader) {
			newResponseHeaders.push(details.responseHeaders[i]);
		}
	}
	
	return {
		responseHeaders: newResponseHeaders
	};
}, {
	urls: ["<all_urls>"],
	types: ['main_frame']
}, ['blocking', 'responseHeaders']);