Chrome Extension: Would changing content_security_policy in manifest disable past users? - google-chrome-extension

Question

I know that changing permissions will disable your existing users, thats why you can use optional permissions. However, content_security_policy adds another layer to this.
Here is my current setup:
My permissions:
"permissions": [
"storage"
],
Currently using content_scripts
"content_scripts": [ {
"all_frames": true,
"js": [
"js/helpers/BrowserStorage.js",
"js/helpers/LocalStorage.js",
"js/helpers/Device.js",
"js/frame.js"
],
"matches": [
"https://example.com/*"
],
"run_at": "document_start"
} ],
And currently using the content_security_policy
"content_security_policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://*.example.com 'self'; object-src 'self'"
This has allowed my current user base to enable access to example.com, without adding example.com into permissions in the first place. Which I feel like I should have done to begin with, nonetheless, I forgot.
Questions
:
If I were to add example.com into the permissions section, would that disable current users, even though my domain is already allowed from the previous 2 sections above?
If I were to change the content_security_policy with either another domain name OR add other elements using the same domain name, would permissions be disabled on existing users?
Example:
if I were to change it to this instead, would existing users be disabled?
"content_security_policy": "default-src 'self' 'unsafe-inline' 'sha256-tempUn1btibnrWwQxEk37lMGV1Nf8FO/GXxNhLEsPdg=' 'sha256-7KQKVSgvvLBSyYII9Tvlef97RiFP4uLjKxCP55HNxC8=' https://example.com; style-src 'self' 'unsafe-inline'; frame-src https://example.com 'self'; object-src 'self'; img-src https://example.com; connect-src https://example.com"
Thanks, hopefully someone might be able to help on understanding what might trigger permissions, I hate to disable existing users, and its almost impossible to really test this.

Answer 1

Browser extensions are loaded on the user's device and store the application manifest and permissions there.
Changing permissions will NOT disable existing users until they update Extension.
After updating, the Extension should check existing permissions and re-ask permissions if it changed those's set.
Otherwice the Extension wil failed to operate properly ("will disable your existing users" in your words).
In case of content_security_policy key in the manifest file the situation is easier.
Past users still have an old Extension with an old manifest and old content_security_policy key value. So they will not be blocked.
After updating the Extension, users will got a new manifest with a new content_security_policy key value, so all should be OK.
PS: The answer is not based on my previous experience, but based only on how things should work.