Maybe? Packaged apps can:

"They can embed remote content in iframes, but that content will not have access to privileged APIs nor will it have the default CSP applied to it."