I have put this in manifest:
"content_security_policy":"script-src 'self' https://www.gstatic.com/ https://*.firebaseio.com https://www.googleapis.com; object-src 'self'"
In popup.html:
<script src="https://www.gstatic.com/firebasejs/3.9.0/firebase.js"></script>
But each time I firebase variable is not defined (console say that)