Estoy usando Recaptcha v3 y he seguido las directivas para agregar al CSP

 <meta http-equiv="Content-Security-Policy" content=" script-src https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; frame-src https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/; ">

según la documentación

pero me estoy poniendo

 Access to fetch at 'https://ssl.gstatic.com/finance/favicon/finance_v2_180x180.png' from origin 'https://www.google.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Después

 m=base:587 Uncaught (in promise) TypeError: Failed to fetch at Kc.j (m=base:587:9)

¿Qué estoy haciendo mal?