So I'm trying to create a chrome extension that uses the Fuse.js library through a web worker (https://cdn.jsdelivr.net/npm/fuse.js@6.6.2, web worker is loaded through a .js file in the extension's code.). In order to do this I'm using the importScripts function e.g. importScripts("https://cdn.jsdelivr.net/npm/fuse.js@6.6.2")

Initially this threw the error:

Refused to load the script 'https://cdn.jsdelivr.net/npm/fuse.js@6.6.2' because it violates the following Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

To solve this I've tried several variations of manifest.json CSP changes but can't seem to be able to get it to work. Here is my most recent attempt (going completely overkill adding everything I can think of)

 "content_security_policy": {
        "extension_pages": "script-src 'self'; object-src 'self'; script-src-elem 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/fuse.js@6.6.2 https://cdn.jsdelivr.net/npm/fuse.js@6.6.2/; default-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&display=swap https://cdn.jsdelivr.net/npm/fuse.js@6.6.2 https://cdn.jsdelivr.net/npm/fuse.js@6.6.2/;",
        "worker-src": "unsafe-inline https://cdn.jsdelivr.net/npm/fuse.js@6.6.2;"
    }

While it's easy enough to change to be able to load the content from CDN within the extension itself, loading it from the web worker seems to be different. Perhaps this may be an unsupported approach, and in that case I'd welcome any recommendations for advice!

Currently another idea of mine would be to load the library to a content script, then have that spawn the web worker, then pass the result of that back to the extension, however this seems like a less elegant approach.

This isn't my area of expertise so would appreciate any help! Thanks.