Content Security Policy errors in Safari

Describe the bug

A from-scratch project shows content security policy errors in Safari in any of the extension web views.

Additionally, when I manually wipe the generated content security policy in the manifest, I see CORS errors.

Reproduction

https://github.com/apexskier/wxt-1908-reproduction

Steps to reproduce

cameronlittle@naches:~/Developer 11:01:56 (⎈ttr)
❯ npx wxt@latest init

WXT 0.20.11                                                                                             11:01:58 AM
ℹ Initializing new project                                                                             11:01:58 AM
✔ Project Directory … test
✔ Choose a template › vanilla
✔ Package Manager › npm
✔ Downloading template

✨ WXT project created with the vanilla template.                                                       11:02:01 AM

Next steps:                                                                                             11:02:01 AM
  1. cd test                                                                                            11:02:01 AM
  2. npm install                                                                                        11:02:01 AM

cameronlittle@naches:~/Developer 11:02:01 (⎈ttr)
❯ cd test
/Users/cameronlittle/Developer/test
cameronlittle@naches:~/Developer/test 11:02:04 (⬢v22.19.0) (⎈ttr)
❯ npm i

> wxt-starter@0.0.0 postinstall
> wxt prepare


WXT 0.20.11                                                                                             11:02:18 AM
[dotenv@17.2.2] injecting env (0) from .env.production.chrome.local,.env.production.chrome,.env.chrome.local,.env.chrome,.env.production.local,.env.production,.env.local,.env -- tip: 🔐 prevent building .env in docker: https://dotenvx.com/prebuild
ℹ Generating types...                                                                                  11:02:18 AM
✔ Finished in 171 ms                                                                                   11:02:18 AM

added 420 packages, and audited 421 packages in 13s

121 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
cameronlittle@naches:~/Developer/test 11:02:18 (⬢v22.19.0) (⎈ttr)
❯ wxt -b safari

WXT 0.20.11                                                                                             11:02:27 AM
[dotenv@17.2.2] injecting env (0) from .env.development.safari.local,.env.development.safari,.env.safari.local,.env.safari,.env.development.local,.env.development,.env.local,.env -- tip: ⚙️  write to custom object with { processEnv: myObject }
✔ Started dev server @ http://localhost:3001                                                           11:02:27 AM
ℹ Pre-rendering safari-mv2 for development with Vite 7.1.7                                             11:02:27 AM
✔ Built extension in 184 ms                                                                            11:02:27 AM
  ├─ .output/safari-mv2-dev/manifest.json               927 B   
  ├─ .output/safari-mv2-dev/popup.html                  636 B   
  ├─ .output/safari-mv2-dev/background.js               19.67 kB
  ├─ .output/safari-mv2-dev/chunks/popup-D3oq4d02.js    7.96 kB 
  ├─ .output/safari-mv2-dev/content-scripts/content.js  24.84 kB
  ├─ .output/safari-mv2-dev/icon/128.png                3.07 kB 
  ├─ .output/safari-mv2-dev/icon/16.png                 559 B   
  ├─ .output/safari-mv2-dev/icon/32.png                 916 B   
  ├─ .output/safari-mv2-dev/icon/48.png                 1.33 kB 
  ├─ .output/safari-mv2-dev/icon/96.png                 2.37 kB 
  └─ .output/safari-mv2-dev/wxt.svg                     1.07 kB 
Σ Total size: 63.36 kB                                                   

 WARN  Cannot Safari using web-ext. Load ".output/safari-mv2-dev" as an unpacked extension manually     11:02:27 AM

[dotenv@17.2.2] injecting env (0) from .env.development.safari.local,.env.development.safari,.env.safari.local,.env.safari,.env.development.local,.env.development,.env.local,.env -- tip: 📡 auto-backup env with Radar: https://dotenvx.com/radar

Open and inspect the popup.

System Info

System:
    OS: macOS 26.0
    CPU: (12) arm64 Apple M2 Pro
    Memory: 192.14 MB / 32.00 GB
    Shell: 3.2.57 - /bin/bash
  Binaries:
    Node: 22.19.0 - /opt/homebrew/bin/node
    Yarn: 1.22.19 - /opt/homebrew/bin/yarn
    npm: 10.9.3 - /opt/homebrew/bin/npm
  Browsers:
    Brave Browser: 136.1.78.94
    Chrome: 140.0.7339.186
    Safari: 26.0
  npmPackages:
    wxt: ^0.20.6 => 0.20.11

Used Package Manager

npm

Validations

• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

Run the linked wxt-1908-reproduction with WXT 0.20.11 and build the Safari target using wxt -b safari. Inspect .output/safari-mv2-dev/manifest.json and the generated popup in Safari, then trace the reported CSP and CORS errors to the generated extension configuration. Done means a from-scratch Safari build can load its extension web views without these errors.