Reading host permission patterns
A pattern begins with a scheme, followed by a host and path. https://example.com/* is limited to one host. https://*.example.com/* includes subdomains. <all_urls> covers every supported scheme and host. The path portion can narrow access, but many extensions use /*.
Manifest V3 stores these patterns in host_permissions. Manifest V2 often places them in the general permissions array alongside API permissions.
| Pattern | Reach | Typical concern |
|---|---|---|
| https://example.com/* | One host | Low, if the site matches the feature |
| https://*.example.com/* | Host and subdomains | Medium; many services use subdomains |
| *://*/* | Every http and https host | Broad; review the feature carefully |
| <all_urls> | All supported schemes and hosts | Broadest website access |
| file:///* | Local files opened in the browser | Can expose local content |
Related pages:what does all_urls meanwebsite access inspector
Host access versus content scripts
Host permissions grant API access to matching URLs. Content scripts are files injected into matching pages. The match patterns can differ, so an extension may request API access to one set of sites and inject scripts into another.
The checker reports both. It also highlights all_frames, which extends injection into iframes, and run_at timing, which affects how early the script sees the page.
Related pages:content script matchesextension content script inspector
What to do with a broad result
Compare the breadth with the product. If the extension only works on one service but requests every site, ask why. Check whether optional host permissions could have been used instead.
Host access is a capability. The report does not claim that the extension read any page. Use code findings and runtime observation for behavior.