Matches are specific

A content script injecting into <all_urls> runs on every page the user visits — banking portals, health records, internal tools — whether or not the extension has any useful function there. CWE-250 governs this: the content script context executes with unnecessary privileges on irrelevant origins. Chrome's match pattern documentation and OWASP A01 (Broken Access Control) both call for the minimal set of origins. Broad injection also degrades browser performance (each injection is a separate script parse and execution per tab), increases memory usage, and creates a larger attack surface for page-to-extension message injection attacks.

Scope matches in manifest.json to the specific domains your extension actually interacts with.

{
  "content_scripts": [{
    "matches": ["https://specific-site.com/*"],
    "js": ["content.js"]
  }]
}

If you genuinely need to support arbitrary pages, combine activeTab with a browser-action click instead of broad static match patterns — this avoids the automatic injection and the install-time warning.