Here's the proof-of-concept extension by gorhill for anyone interested: <a href="https://gist.github.com/gorhill/b0316e35d4e7e4a44df39e8b7fa5ac20" rel="nofollow">https://gist.github.com/gorhill/b0316e35d4e7e4a44df39e8b7fa5...</a>. Looks like his tweets regarding this have also been deleted.
Even without this issue all chrome extensions can execute code in their own context by explicitly setting a blob script-src rather than relying on the default, or by skipping the middle step and adding a domain they control to the script-src and directly linking a javascript file (why bother with blobs?), or even by pushing a new version which Chrome will automatically install for users. The title makes this issue sound severe but it's just a missing best practice.
I think this is by design maybe<p><a href="https://developer.chrome.com/extensions/contentSecurityPolicy" rel="nofollow">https://developer.chrome.com/extensions/contentSecurityPolic...</a><p>Look at the section named "Evaluated Javascript"