Invalid value for 'content_security_policy'

What you see

Invalid value for 'content_security_policy'. Could not load manifest.

Why it happens

In version 2 the security policy was one line of text. Version 3 wants an object with "extension_pages" (and "sandbox" if the extension has sandboxed pages). A plain line in a version 3 manifest stops it loading.

The fix

rightsocket does this Moves the policy into { "extension_pages": "…" }.
rightsocket does this Takes out anything version 3 refuses in it, such as 'unsafe-eval' or a website address, and marks it Check.

What changed, and when

24 July 2025, Chrome: Chrome 138: Manifest V2 extensions disabled for all users on all channels, with no option to turn them back on. Chrome 139 then removed the enterprise policy that kept them working.

Sources

Chromium source: content_security_policy must be a dictionary in version 3 (csp_info.cc)
Chrome for Developers: content_security_policy in the manifest
Stack Overflow: "Failed to load extension. Invalid value for 'content_security_policy'"

Other chrome extension errors

Manifest version 2 is deprecated
Service worker registration failed. Status code: 15
Manifest is not valid JSON
Could not load icon specified in the manifest
Refused to execute inline script (Content Security Policy)
chrome.browserAction is undefined (Manifest V3)
'browser_action' requires manifest version of 2 or lower
'webRequestBlocking' requires manifest version of 2 or lower
Permission is unknown or URL pattern is malformed
Invalid value for 'web_accessible_resources[0]'
Insecure CSP value in directive 'script-src'