The CSP changes primarily address the XSS issue in extensions. Many of these vulnerabilities come because extension developers run code from untrusted sources. CSP blocks that in most cases.

Separately, we implemented web_accessible_resources. That addresses the sniffing issues.