Popup.js file:
window.fbAsyncInit = function() {
// init the FB JS SDK
FB.init({
appId : ******, // App I
The first error is from Chrome. You need to set content_security_policy but indeed you did. The strange is that your content_security_policy directive totally works for me:
"content_security_policy": "script-src 'self' https://connect.facebook.net; object-src 'self'",
The second error is from Facebook. Because you cant allow a "chrome-extension" pseudoprotocol in the Facebook app settings you should use a login method like this:
https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/v2.0