Simplest way to access media files on Android using Cordova

I need to access files in a Cordova app targeting Android. I need to be able to do it by passing a URI (e.g. "file://..." or "https://...") because that's the format I need to pass an API that will open the files (Howler.js to play .mp3 files).

This seems to rule out cordova-plugin-file, as far as I understand it. I have tried both hosting locally and remotely. I have tried installing cordova-plugin-whitelist. My config.xml contains

<access origin="*"/> <allow-navigation href="*"/> and my html contains <meta http-equiv="Content-Security-Policy" content="default-src *; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *; img-src 'self' data:"/>.

I'm thus covering as many bases as I can find mentioned in any documentation, but no joy - permission to access the files is always denied. Suggestions much appreciated.

EDIT -------------------

In response to Eric below I have tried editing my config.xml and it is now as follows:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<widget id="io.cordova.hellocordova" version="1.0.0" xmlns="http://www.w3.org/ns/widgets" xmlns:cdv="http://cordova.apache.org/ns/1.0">
  <name>HelloCordova</name>
  <description>&#xD;
        A sample Apache Cordova application that responds to the deviceready event.&#xD;
    </description>
  <author email="dev@cordova.apache.org" href="http://cordova.io">&#xD;
        Apache Cordova Team&#xD;
    </author>
  <content src="index.html"/>
  <access origin="*"/>
  <allow-intent href="http://*/*"/>
  <allow-intent href="https://*/*"/>
  <allow-intent href="tel:*"/>
  <allow-intent href="sms:*"/>
  <allow-intent href="mailto:*"/>
  <allow-intent href="geo:*"/>
  <platform name="android">
    <allow-intent href="market:*"/>
    <access origin="*"/>
    <preference name="AndroidInsecureFileModeEnabled" value="true" />
  </platform>
  <platform name="ios">
    <allow-intent href="itms:*"/>
    <allow-intent href="itms-apps:*"/>
  </platform>
  <!-- <hook src="node_modules/cordova-import-npm/scripts/importNpmPackages.js" type="before_prepare"/> -->
</widget>

However my build now crashes with an error message visible here

You can try to add

<preference name="AndroidInsecureFileModeEnabled" value="true" />

to your config.xml, most probably a CORS issue.