externally_connectable: who can send messages to a browser extension

The externally_connectable manifest key controls which other extensions and which web pages can connect to your extension through runtime.connect and runtime.sendMessage. If you leave it out, all extensions can connect and no web pages can. Setting it carelessly can open the door wider than you meant.

The defaults

Google's reference gives the baseline. When the key is absent:

• All extensions can connect.
• No web pages can connect.

Adding the key changes that. The page warns that adding it without "ids": ["*"] can stop other extensions from connecting, an effect it calls a possibly unintended consequence. That cuts both ways: it can be a way to shut other extensions out, or a surprise that breaks an integration.

The two lists

• ids holds extension IDs allowed to connect. If empty or unspecified, no extensions or apps can connect. The value "*" allows all.
• matches holds match patterns for web pages allowed to connect. If empty or unspecified, no web pages can connect.

A typical config that lets one of your own sites talk to your extension looks like this:

"externally_connectable": {
  "ids": [],
  "matches": ["https://app.example.com/*"]
}

Why this is a security decision

Any page matching your pattern can send your extension a message. If a message handler does something sensitive, a cross-site scripting bug on that page becomes a way to drive your extension. Google's network guidance makes a related point: do not let content scripts request arbitrary URLs, because a malicious page could forge messages and use the extension to reach cross-origin resources. The same reasoning applies here.

Safer practice

1. List exact origins, not wide wildcards. Avoid patterns that cover every subdomain unless you control all of them.
2. Treat every incoming message as untrusted input. Validate the shape and values.
3. Send identifiers, not URLs or code, and build requests inside the extension.
4. Keep the handler's power small. A message should never be able to trigger a privileged action without a check.
5. Decide whether other extensions should reach you at all, and set ids on purpose.

For reviewers

When you read a third-party manifest, look for this key. A short list of first-party origins is normal for an extension with a companion site. A broad list, or "*" for ids, deserves a question. Pair this with a look at match patterns.

Common mistakes

Developers copy a sample manifest with a wide pattern and never narrow it. Others add the key to block other extensions and forget it also changes who can message them. After each release, diff the manifest and check that this block still lists only what you intend.

Quick check

Sources

• externally_connectable manifest key
• Extension network requests

Last reviewed: 19 October 2026.