CSP doesn't impose that restriction, but it's something we're changing at the same time:

"A package's resources are no longer available by default to external websites (as the src of an image, or a script tag)."

http://code.google.com/chrome/extensions/dev/manifestVersion...