The global webRequest.onHeadersReceived CSP rewrite was attached to session.defaultSession, which intercepts every Chromium request (including devtools and network service internals) and crashed the network service in dev. Drop the global override and rely on the renderer-level meta tag, widened to allow Vite's localhost HMR connections.