Agent Wranglers

DSK-32Recommended

Expose as few extension files to web pages as you can

List under web_accessible_resources only the files a web page must load, with matches set to the exact sites that need them. In Chrome, set use_dynamic_url to true.

By Agent Wranglers. Updated .

How to do it

By default no extension file is reachable from web pages. Chrome warns that each exposed file lets a site detect the extension, which helps fingerprint the user, and lets it probe the file for holes. A dynamic ID changes every session, so a site cannot test a fixed address. Never expose a page that acts on its address or on messages, such as an options page. Review this list with the permissions of Ask for the fewest permissions the extension needs.

Examples

JSON example

{
  "web_accessible_resources": [
    {
      "resources": ["badge.svg"],
      "matches": ["https://app.example.com/*"],
      "use_dynamic_url": true
    }
  ]
}

How to check

A test reads the built manifest. No entry has <all_urls> or *://*/* in matches, and a content script loads every listed file. A test page on a site outside matches fails to fetch each listed file.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/browser-extensions/web-accessible-resources">Agent Wranglers desktop apps and extensions playbook</a>. In code you write, add a comment next to it with the same link.