Message sender is validated

CWE-346 (Origin Validation Error) describes exactly this failure: a message listener that does not check sender.id will execute privileged extension logic when called by any other extension or web page that can reach the runtime. If externally_connectable is open, a malicious website can send crafted messages to trigger background actions — deleting data, making API calls, or exfiltrating stored tokens. CWE-20 (Improper Input Validation) compounds this when the message payload itself is trusted without validation. OWASP A01 (Broken Access Control) applies: the background script is a privileged context and its listeners are the access-control boundary.

Check sender.id against chrome.runtime.id in every onMessage and onConnect handler in your background script before processing the payload.

// src/background.js
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
  if (sender.id !== chrome.runtime.id) return; // reject foreign senders
  // safe to process message
});

For pages listed in externally_connectable, additionally validate sender.url against an allowlist of your own domains.