diff --git a/webpack.config.js b/webpack.config.js
index 91cbea8..6c8667c 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -113,7 +113,11 @@
       'base-uri': '\'self\'',
       'object-src': '\'none\'',
       'script-src': ['\'self\''],
-      'style-src': ['\'self\'']
+      'style-src': ['\'self\''],
+      // KVM requires image buffers from data: payloads, so allow that in
+      // img-src
+      // https://stackoverflow.com/questions/18447970/content-security-policy-data-not-working-for-base64-images-in-chrome-28
+      'img-src': ['\'self\'', 'data:'],
     }),
     new MiniCssExtractPlugin(),