A match pattern is a URL like string that tells the browser which sites an extension may access. It has a scheme, a host and a path. Patterns with a wildcard host, such as any https site, or the special all_urls value, give the widest reach and deserve the most scrutiny.
The shape of a pattern
Chrome documents the structure as scheme, host, optional port, then path. In practice you will see things like these.
https://mail.google.com/*
*://*.example.com/*
https://*/*
The first is one host on https. The second is example.com and all its subdomains on http or https. The third is every https site.
The parts
Scheme. It can be http, https, file or a wildcard. The wildcard covers only http and https, not file.
Host. An exact name, a leading wildcard for subdomains, or a bare wildcard for any host. The wildcard has to be the first or only character in the host.
Port. Optional. If you leave it out, all ports match.
Path. For host permissions the path is required but ignored, so developers write a slash and a star by convention.
The special values
all_urls matches any URL with a permitted scheme. Chrome notes that because it affects all hosts, Web Store review may take longer. That is a useful hint about how the platform views it.
The file scheme is different. Access to local files requires the user to grant it manually, which you can do from the extension's details page.
Chrome does not support wildcards for top level domains, so developers must list each one. If an extension lists a long string of country domains, that is normal, not suspicious on its own.
Reading a request as a user
Ask three questions.
- Does the scope match the job? A coupon tool listing a few shop domains is plausible. A screenshot tool listing every https site is broader than it needs unless it uses activeTab.
- Is the list stable? Chrome disables an extension until you accept a new permission that triggers a warning, so a widened list should prompt you. Read it.
- Can I narrow it? Chrome lets you set site access on click or on specific sites, which overrides broad requests in practice.
Why this matters beyond Chrome
Firefox uses the same pattern syntax for host permissions, and in Manifest V3 they sit under host_permissions. Host permissions let an extension make cross origin requests, read tab metadata, inject content scripts and observe web requests for those hosts. So a pattern is not only about reading pages, it is also about where data can go.
Quick check
Is a wildcard subdomain pattern dangerous?
Not by itself. It covers every subdomain of one site, which is much narrower than a wildcard host. Judge it by whether you trust that site and the extension.
Does the path part limit access?
Not for host permissions. The path is required but ignored, so only scheme, host and port limit access.
Sources
- Match patterns (Chrome for Developers)
- Permissions manifest key (MDN)
- Permission warnings (Chrome for Developers)
Last reviewed: 19 October 2026.
