Web accessible resources: how extensions expose files to websites

By default no file in a Chrome extension can be loaded by a web page. The web_accessible_resources manifest key opens specific files to the pages or extensions you name. Every file you list becomes reachable from outside, so a short, exact list is the safe approach.

Why the default is closed

Google's reference says that by default no resources are web accessible, and ties this to stopping malicious sites from fingerprinting installed extensions or exploiting bugs such as cross-site scripting inside them. If a page can load a file at a known extension URL, it can tell the extension is installed. That is a quiet way to learn about a visitor.

How access is granted

Each entry is a rule with a resources list and either matches or extension_ids:

"web_accessible_resources": [
  {
    "resources": ["images/logo.png"],
    "matches": ["https://example.com/*"]
  }
]

For matches, only the origin counts and subdomains match. A pattern with a path other than /* produces an invalid match pattern error. Resources load from a chrome-extension:// URL and are served with CORS headers, so fetch() works against them.

Wildcards expose more than you think

Google's page gives two examples. "/images/*" exposes a directory recursively, and "*.png" exposes every PNG file. A convenient wildcard can quietly publish files you never meant to share, including HTML pages that run extension code.

Dynamic URLs

An optional use_dynamic_url setting allows access only through a dynamic ID, generated per session and changed when the browser restarts or the extension reloads. Google's page does not claim that this setting prevents fingerprinting, so treat it as one layer, not a cure.

Rules of thumb

1. List individual files, not folders.
2. Limit matches to the origins that need the file.
3. Never expose an extension page that performs privileged actions unless its input handling has been reviewed.
4. Remember content scripts do not need to be listed, so do not add entries just to make them work.
5. Revisit the list at every release. Old entries tend to stay forever.

For reviewers

When you inspect a manifest, a very large list, or entries with matches that cover every site, is a sign the developer was not thinking about exposure. Compare with what the extension actually does. The five minute audit guide covers where to look.

Common mistakes. The usual one is exposing a whole folder because one image inside it was needed. Another is listing a page that was only used during development. Run a quick audit before each release: for every entry, name the site that needs it and the reason.

Quick check

Sources

• web_accessible_resources manifest key

Last reviewed: 19 October 2026.