I'm using Recaptcha v3 and I've followed the directives to add to the CSP

<meta http-equiv="Content-Security-Policy" content="
script-src https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/;
frame-src https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/;
 ">

as per the documentation

But I'm getting

 Access to fetch at 'https://ssl.gstatic.com/finance/favicon/finance_v2_180x180.png' from origin 'https://www.google.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Then

 m=base:587                  Uncaught (in promise) TypeError: Failed to fetch
at Kc.j (m=base:587:9)

What am I doing wrong?