UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36

Steps to reproduce the problem:
1. Have a web page which uses a Content-Security-Policy header restricting image sources.
2. Have an extension which inside a content script injects a <link rel="stylesheet" ...> element into the page:

    var style = document.createElement('link');
    style.rel = 'stylesheet';
    style.type = 'text/css';
    style.href = 'https://.../injected.css';
    document.head.appendChild(style);

3. Any images that stylesheet includes may be blocked by CSP: "Refused to load the image 'https://.../....png' because it violates the following Content Security Policy directive: "..."."

For example, download https://crashcoherency.net/misc/exttest/test.zip, extract it, load it as an unpacked extension, and go to https://crashcoherency.net/misc/exttest/ to see the above issue.
(This example extension also demonstrates Issue 392338 and Issue 408932.)

What is the expected behavior?
The image should not be blocked, since extensions should be able to bypass the page's CSP.

What went wrong?
Chrome allowed the stylesheet itself to load, bypassing the page's CSP, but it didn't give the same treatment to images that the stylesheet referenced.

WebStore page: 

Did this work before? No 

Chrome version: 53.0.2785.116  Channel: stable
OS Version: OS X 10.11.4
Flash Version: 

Some previous discussion of this and other extension CSP issues took place in  Issue 391128 .