What Does all_urls Permission Mean? Broad Website Access

What does the <all_urls> permission mean?

Short answer

<all_urls> is a host permission that matches every URL scheme and website an extension is allowed to access. It lets content scripts run on, and extension APIs reach, nearly any page you visit, including logged-in accounts. It describes reach, not proof that the extension reads or collects your data.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Which sites does <all_urls> cover?

<all_urls> covers http, https, file and other supported schemes. In practice, a content script with this match can run on almost every ordinary web page. The extension still needs the relevant API permission for specific browser data.

A more limited pattern names one host or a wildcard subdomain. Broad wildcard patterns and all_urls are common in ad blockers, password managers, accessibility tools and developer utilities, which makes context essential.

What can an extension do with it?

With all_urls and the right supporting permissions, an extension can inject scripts, read page content, observe navigation, modify forms and send messages between contexts. Without scripting or API permissions, the practical reach is smaller.

A content script can also read document.cookie where cookies are not HttpOnly. The cookies permission is separate and grants broader cookie API access.

How to decide whether to accept it

Ask whether the feature genuinely requires every site. A password manager may need to recognize login forms everywhere; a shopping coupon tool may need many retail sites; a niche utility usually does not need all_urls.

Look for narrow alternatives, check the publisher's privacy policy and restrict site access in the browser if the extension supports it. Review again after updates.

Frequently asked questions

Does <all_urls> include my bank and email?

It can include them if they are ordinary web pages and the extension runs a content script there. Highly sensitive sites may use additional protections, but you should assume broad reach.

Is <all_urls> the same as the cookies permission?

No. all_urls is website access. cookies is a separate API permission that allows cookie operations beyond page-level access.

Can I grant all_urls to one site only?

Some browsers let you restrict an installed extension's site access. That limits runtime behavior but does not change what the extension requested.

Why do ad blockers request all_urls?

They need to inspect and modify requests or page content on many sites. That can be legitimate, but the rule lists and publisher still matter.

Last reviewed: October 31, 2026