I ran into something along these lines just the other day. I have a private extension that replaces some embedded videos with a custom player. Last week, the se

I ran into something along these lines just the other day. I have a private extension that replaces some embedded videos with a custom player. Last week, the server API I'd been pulling video metadata from went down. I found another API endpoint and modified the extension to use it, but the new URL had CSP enabled and threw CORS errors when used in-browser. Unlike Chrome, this browser's extensions can't modify security headers, so I wrote a little shim utility to perform the request on a local server and pointed the extension at that instead.