We have a chrome extension that modifies the DOM of a web page and inserts an object tag within which it loads an HTML page for our business users for a specific set of websites. One such website that we target has a content security policy stated in the meta tag as

<meta http-equiv="Content-Security-Policy" object-src 'self' https://xxxxxx.com;>

Is there any way to overcome this CSP and insert the "object" tag and load our content?

Note: iframe option is ruled out.