Dear Jacques,
Greetings of the day

Yes the issue can be because you are using them in iFrame and giving CSP rules in Media-src.
You can just try one more thing here which we tried sometimes before due to similar issue of loading external content in iFrame.

In Frame-ancestors instead of *, you can mention specific URLs and domains.
Also note that google data URLs are not limited to *.google.com.
Because for our case, we came to know that we need to include https://www.gstatic.com as its also part of google static data like stylesheet, scripts, fonts etc...

Let us know if this above solution works for you.

Regards,

Hi Palak , thx for the reply.

I tried to add this : 

But it still gives me this 403 Forbidden.

I can see in log it still says : 

Content Security Policy blocked 'https://drive.google.com/file/....etc

Dear Jacques,
Greetings

Can you try to add the similar values in script-src as well ?
Also check following post where similar kind of issue is addressed.
Content Security Policy blocked 'https://maps.googleapis.com' | OutSystems

Kindly note that you need to add CSP for directive accroding to your errors.
For example, if you will check error log, it will say violated directive : script-src then you need to add in script for the same. Example below: 

Regards,

Palak Patel

Thanks so much for help Palak.

I got the CSP correct and I also need to add drive/preview instead of /view in the link.

Jacques