# Matches are specific

- **Pattern:** `ab-001331` (`extension-permissions-security.content-script-isolation.specific-matches`)
- **Severity:** medium
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-001331
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-001331)

## Why it matters

A content script injecting into `<all_urls>` runs on every page the user visits — banking portals, health records, internal tools — whether or not the extension has any useful function there. CWE-250 governs this: the content script context executes with unnecessary privileges on irrelevant origins. Chrome's match pattern documentation and OWASP A01 (Broken Access Control) both call for the minimal set of origins. Broad injection also degrades browser performance (each injection is a separate script parse and execution per tab), increases memory usage, and creates a larger attack surface for page-to-extension message injection attacks.

## Severity rationale

Medium because over-broad match patterns inject the content script into sensitive origins (banking, health) where the extension has no purpose, compounding any content-script XSS into a cross-origin exposure.

## Remediation

Scope `matches` in `manifest.json` to the specific domains your extension actually interacts with.

```json
{
  "content_scripts": [{
    "matches": ["https://specific-site.com/*"],
    "js": ["content.js"]
  }]
}
```

If you genuinely need to support arbitrary pages, combine `activeTab` with a browser-action click instead of broad static match patterns — this avoids the automatic injection and the install-time warning.

## Detection

- **ID:** `specific-matches`
- **Severity:** `medium`
- **What to look for:** List all `matches` patterns in `content_scripts` from `manifest.json`. Count the number of broad patterns (`<all_urls>`, `*://*/*`) vs specific domain patterns.
- **Pass criteria:** All match patterns are specific to the domains the extension targets. No more than 0 broad patterns like `<all_urls>` or `*://*/*` are used unless the extension is explicitly a general-purpose tool. Report the count of match patterns found and their specificity.
- **Fail criteria:** `matches` contains `<all_urls>` or `*://*/*` when the extension is not a general-purpose web tool.
- **Skip (N/A) when:** Extension is a general utility (like a password manager) that must run everywhere.
- **Detail on fail:** `"Content script injects into <all_urls>. This impacts performance and privacy on every page visit."`
- **Remediation:** Scope your content scripts in `manifest.json` to specific sites whenever possible.

  ```json
  { "content_scripts": [{ "matches": ["https://specific-site.com/*"], "js": ["content.js"] }] }
  ```

## External references

- cwe CWE-250
- owasp A01
- external chrome-match-patterns — https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns

Taxons: access-control

HTML version: https://auditbuffet.com/patterns/ab-001331