externally_connectable Explained - Extension Messaging

Extension externally_connectable explained

Short answer

externally_connectable lets specified websites send messages to an extension and, in some configurations, lets the extension message them. It defines external message origins rather than general website access. Broad origins such as <all_urls> mean many sites can attempt to reach the extension's message handlers.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What the field controls

By default, web pages cannot connect directly to an extension's runtime messaging. externally_connectable opens that channel for listed origins and extension IDs. The extension must still implement message handlers.

The field is about communication, not DOM access. A site does not need a content script to send a message if the origin is allowed, although the extension decides whether to respond.

Why broad origins matter

An entry of <all_urls> means any website can attempt to connect. If a handler exposes privileged operations without validating the sender, another site could trigger them. The risk depends on the handler's authorization logic.

Even a narrow origin list deserves review when it includes sites the publisher does not control, because a compromised site could send crafted messages.

Related pages:extension CSP source analyzer

What to look for in the code

Search for runtime.onMessageExternal and runtime.onConnectExternal handlers. Check whether the sender origin is validated, whether messages are authenticated and whether the handler can access sensitive APIs or data.

A static analyzer can flag the manifest value and the handler references, but it cannot prove that exploitation is possible. Treat findings as review prompts.

Frequently asked questions

Does externally_connectable grant website access?

No. It allows cross-origin messaging with the extension. Website content access is granted through host permissions and content scripts.

What does <all_urls> mean in externally_connectable?

Any website origin can attempt to send a message to the extension. The extension's handlers decide whether and how to respond.

Can an extension message a website with this field?

The field primarily allows web pages to connect to the extension. Messaging direction and availability depend on the API and the extension's implementation.

Last reviewed: October 31, 2026