Content Script Match Patterns Explained

Content script match patterns explained

Short answer

A content-script match pattern tells the browser where to inject an extension's script. It has a scheme, host and path. Patterns can name one host, use wildcard subdomains, cover every URL or target local files. The pattern defines injection reach, not whether the script reads or sends data.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Pattern anatomy

The scheme is http, https, file or a wildcard. The host can be a domain, a wildcard subdomain or an asterisk. The path must begin with a slash and can include a wildcard.

https://example.com/* matches only that host. https://*.example.com/* matches the base domain and subdomains. <all_urls> is a special shorthand for all supported schemes and hosts.

Match pattern examples
Pattern	Matches	Breadth
https://example.com/*	One HTTPS host	Narrow
https://.example.com/	Domain and subdomains	Medium
://example.com/	HTTP and HTTPS on one host	Medium
:///*	All HTTP and HTTPS hosts	Broad
<all_urls>	All supported schemes and hosts	Broadest

run_at and all_frames

run_at controls when injection occurs. document_start runs before the page DOM is fully built, document_end runs after the DOM is ready, and document_idle runs later when the browser decides the page is quiet.

all_frames allows the script to run in matching iframes. That can be necessary for embedded forms or editors, and it expands where the code can observe content.

Evaluating injection reach

Compare the pattern with the feature. A tool that improves one web app should not need every site. A password manager or content blocker may need broad reach, but it should explain how page data is handled.

The inspector lists the matched hosts, the injected files and related static findings. Use it to decide whether the script's access is proportionate.

Frequently asked questions

Do content scripts need host permissions?

The match patterns in content_scripts define where injection is allowed. In Manifest V3, host_permissions separately grant API access to those hosts. Both can coexist.

Can a content script run on every page?

Yes, with <all_urls> or an equivalent broad pattern. The extension must also be permitted by the browser and user.

Does document_start see the full page?

No. It runs very early, before the page is fully parsed. It may need to wait for DOMContentLoaded or observe mutations.

Last reviewed: October 31, 2026