Refused to frame '' because it violates the following Content Security Policy directive: "frame-src *"
Had exactly that problem today. I solved it by using
frame-src data:
Btw. '*' is only a wildcard for urls. data: 'unsafe-inline' and 'unsafe-eval' have to be added individually.