[Chrome Extension 1.2.27221.15725] Packaged font and favicon badge are blocked by CSP; repeated Statsig initialization warnings

Environment

• ChatGPT Chrome Extension: 1.2.27221.15725
• Observed: 2026-07-26

Summary

The packaged extension contains visual resources that are rejected by the applicable CSPs, while its side-panel runtime repeatedly emits Statsig initialization warnings. Core browser-client control remains operational, so this report is intentionally low severity and does not claim a core connection failure.

Confirmed console evidence

A fresh extension-console readback contained 43 entries in four message classes:

1. 1x extension CSP error: an embedded data:font/woff2 resource was blocked by:

font-src 'self' https://cdn.openai.com

1. 39x Statsig warnings: required id_type userID was absent when evaluating gates/dynamic configs.
2. 1x Statsig warning: multiple clients were created with the same SDK key.
3. 2x page CSP errors: a data:image/svg+xml Codex favicon badge was blocked by the page's img-src 'self' https://challenges.cloudflare.com policy.

Package correlation

Read-only inspection of the installed package showed:

• side-panel CSS embeds the data: font;
• background.js and content-scripts/codex.js contain the data-codex-favicon-badge resource;
• the side-panel JavaScript bundle contains the duplicate-Statsig-client warning path;
• the manifest CSP does not allow the embedded font's data: source.

This ties the errors to packaged resource/CSP and initialization behavior rather than Windows, router, or browser-profile settings.

Expected behavior

• Resources shipped and used by the extension should load under the applicable extension/page CSP, or use a CSP-compatible packaged URL.
• Statsig should initialize once with the required identity state before gate/config evaluation.
• A healthy browser-client session should not continuously generate repeated initialization warnings.

Actual behavior and impact

• The custom font and injected favicon badge are blocked.
• Statsig generates repeated missing-userID warnings and one duplicate-client warning.
• Confirmed direct impact is console noise and missing custom visual assets.
• Per-user experiment/config evaluation may be skipped or inconsistent, but no functional impact from that has been proven.
• The extension was enabled, its service worker and 30-second heartbeat were present, and a lightweight official browser-client call completed without error.

Suggested fix

• Serve the font from a packaged extension URL permitted by CSP instead of embedding it as data:.
• Use a page-CSP-compatible favicon badge route, or avoid injecting the data: image into pages that reject it.
• Create a single Statsig client and defer gate/config evaluation until the required identity is available.
• Add a packaged-extension regression check that loads the side panel and badge under the declared CSP and asserts no repeated Statsig initialization warnings.

No usernames, profile paths, private URLs, credentials, account identifiers, or raw private logs are included.