web_accessible_resources Security

Extension web_accessible_resources security

Short answer

web_accessible_resources lists extension files that web pages or content scripts can load. It can expose scripts, images or styles to matching sites. Broad resources and matches increase the exposed surface, but exposure alone does not mean a file contains secrets or that a site used it.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What the field exposes

By default, extension files are not directly loadable from web pages. web_accessible_resources grants that ability for listed paths and, in Manifest V3, usually for listed origins.

This is common for images referenced by content scripts, injected styles or worker scripts. It becomes a security concern when sensitive files, source maps or broadly reusable assets are exposed.

Related pages:privacy guide manifest viewer

Paths, matches and wildcards

Manifest V3 uses an array of objects with resources and matches. Manifest V2 uses an array of strings. Wildcards can expose more files than intended, and broad matches let many origins load them.

The analyzer flags serialized values that contain <all_urls>, a bare asterisk or broad path wildcards. It shows the configuration but does not open every exposed asset.

Reviewing the exposure

List the exposed files and ask whether each one needs to be reachable from a web page. Check for scripts that could be reused by another site and for files that reveal internal endpoints or build paths.

web_accessible_resources does not grant access to extension APIs or user data. It controls file loading, so the impact depends on what the files contain.

Frequently asked questions

Are web-accessible resources a security risk?

They can be if they expose sensitive files or if broad matches let untrusted sites load them. Most extensions expose a small number of assets for legitimate reasons.

What changed in Manifest V3?

V3 uses objects with resources and matches, which makes the allowed origins explicit. V2 used a flat string list.

Can websites read all extension files?

No. Only the resources explicitly listed and allowed by the match configuration can be loaded.

Last reviewed: October 31, 2026