I have developped a chrome web extension, where I inject a .js in a website to automate some task. And it works well. But, whenever I put that tab in the background, it doesn't ! (It lags/skip setTimeout())

So, after a bit of googling, I heard it was 'normal and intended behavior' and peoples suggested to use Web Workers. But now, when I try and inject a webworker, the site tells me it's impossible because of CSP directives

here is a sample code :

injecter.js (that works out fine)

if(nbrTabs > 0){

    chrome.tabs.executeScript(tabs[0].id, {file: "worker.js"}); 
    chrome.tabs.executeScript(tabs[0].id, {file: "utilities.js"});      
            
    DisableStart();
    EnableStop();
    save();
}

worker.js

function main(){                            
    
    setTimeout(function(){
        console.log("Do the things ...");
        buttonOnThePage.click();
    }, 1000);

    return null;
}

onmessage = function(e){
    console.log("Worker Start\n");
    main();
    postMessage("Worker End");
}

utilities.js

var worker = new Worker("./worker.js");

worker.onmessage = function(e) {
    worker.terminate();
};

worker.postMessage('Start'); 

When using those, I get an error in the console saying

GET https://www.example.com/bar/utilities.js 404

So, I guess it doesn't work. So, I tried a second thing, where I have my worker AND my main 'thread' on the same file resulting in :

utilities.js

var string = `
function main(){                            
    
    setTimeout(function(){

        console.log("Do the things ...");
        buttonOnThePage.click();

    }, 1000);

    return null;
}

onmessage = function(e){
    console.log("Worker Start\n");
    main();
    postMessage("Worker End");
}`;

var blob = new Blob([string], {type: 'application/javascript'});
var worker = new Worker(URL.createObjectURL(blob));

worker.onmessage = function(e) {
    worker.terminate();
};

worker.postMessage('Start'); 

But now, I have an error telling me "Failed to construct 'Worker': Access to the script at 'blob:https://www.example.com/some-rando-strings' is denied by the document's Content Security Policy."