The "injected script" runs in a different JS context (in the unsafe "MAIN" world), so it doesn't have access to `chrome` API, which is exposed only in the safe content script's default "ISOLATED" world.
For a content script that runs in all sites you'll have to use CustomEvent messaging between the default content script and the injected script (example:
https://stackoverflow.com/a/19312198/). The content script will use chrome.runtime.sendMessage to relay the message to the background script.
In case the content script runs only in a few specified sites you can use
external messaging, but that doesn't apply to your case.
BTW since you use document_start your goal is probably to run the injected script before the page runs its scripts, but it's not what happens now because the script element you've added is loading asynchronously due to the use of `src`, so it will run after an inline <script>foo</script> in the page as well as possibly other small remote scripts. The solution is to declare the injected script separately in manifest.json so you don't need to inject it manually:
"content_scripts": [{
"matches": [...],
"js": ["content.js"],
"run_at": "document_start"
}, {
"matches": [...],
"js": ["injected.js"],
"run_at": "document_start",
"world": "MAIN"
}],
* remove injectScript function from content.js, add CustomEvent messaging
* remove "web_accessible_resources" from manifest.json
* remove "type": "module" from content_scripts in manifest.json as there's no such key and there's no way to declare a module content script.