externally_connectable is restricted

CWE-346 (Origin Validation Error) and CWE-284 (Improper Access Control) both apply to an externally_connectable configuration that uses wildcards. With ids: ['*'] or matches: ['*://*/*'], any installed extension or any website can send messages directly to your extension's background script via chrome.runtime.connect or chrome.runtime.sendMessage. This turns your background script's message handlers into a public API callable by adversaries. OWASP A01 (Broken Access Control) governs this: externally_connectable is an explicit access grant and must enumerate specific callers. Chrome's documentation is explicit that wildcard ids and matches are dangerous defaults.

Enumerate specific extension IDs and specific domain patterns in manifest.json externally_connectable. Never use * in ids or <all_urls> in matches.

"externally_connectable": {
  "ids": ["your-companion-extension-id-here"],
  "matches": ["https://yourdomain.com/*"]
}

If no external connections are needed, omit externally_connectable from the manifest entirely — its absence means only same-extension content scripts can message the background.