In my chrome extension code, I need to inject a <script> tag with code, but I get this error:

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'"

So I added the content_security_policy to my manifest.json file, but now I get another error:

My manifest is as follows:

{
  "manifest_version": 3,
  "name": "...",
  "description": "...",
  "version": "1.1",
  "author": "...",
  "icons": {
    "48": "favicon48.png",
    "256": "favicon256.png"
  },
  "permissions": [
    
  ],
  "content_scripts": [
    {
      "matches": [
        "http://skribbl.io/*",
        "https://skribbl.io/*"
      ],
      "js": [
        "words.js",
        "content.js"
      ],
      "run_at": "document_end"
    }
  ],
  "content_security_policy": {
    "sandbox": "script-src 'self' 'unsafe-inline'"
  }
}