This follow the discussion that first happens there:
https://codereview.chromium.org/2655463006/#msg126

When a navigation is initiated from an isolated world, the Content-Security-Policy of the main world should not be enforced. For the moment, the browser knows what to do with the pseudo boolean: common_navigation_params.should_check_main_world_csp.

For security reasons, it would be nice to pass the origin of the isolated world. Then the browser would be able to double check that it corresponds to an extension that was supposed to run an user script in the page.