After additional info in comments the situation becomes clear.
Due to security reasons the file:-URLs like file:///path/to/file/index.html are prohibited to be opened in nested browsing context (iframe, object, embed) regardless of CSP. Also <a href='file:///path/to/file/index.html'> is prohibited to navigate.
You cannot get around this limitation by using CSP. Moreover, the frame-ancestors directive does not supports non-network schemes for it loses its meaning.
Also looks like the console message shown belongs Safari and it's misleading a little bit.
Chrome should show real violation reason like: Refused to load iframe file:///path/to/file/index.html because it violates the following Content Security Policy directive:....
Note. Chrome browser allows to access local filesystem using file:/// scheme in case of loading images/styles/scripts etc:
<img src='file:///c:/img.png'>
<script src='file:///c:/scripr.js'></script>
<link rel='stylesheet' href='file:///c:/style.css'>
and even supports the file: scheme in CSP.
But AFAIK browser extensions should not use direct access via file:///-URLs. Extensions have to use own packaged resources or the File API
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
