Web accessible resources are scoped

CWE-200 (Information Exposure) applies directly: resources listed in web_accessible_resources with matches: ['<all_urls>'] are fetchable by any website on the internet. This enables extension fingerprinting — a site can probe for specific resource paths to detect which extensions a user has installed, bypassing privacy expectations. OWASP A01 (Broken Access Control) governs the broader failure: the resource exposure is an access grant, and that grant should be minimal. Chrome's web_accessible_resources MV3 API was specifically redesigned to require a matches array precisely to close the fingerprinting vector that the MV2 API left open.

Scope every web_accessible_resources entry in manifest.json to the specific domains that actually need access to those resources.

"web_accessible_resources": [{
  "resources": ["icon.png", "injected.css"],
  "matches": ["https://yourdomain.com/*"]
}]

If a resource is only needed by your own content scripts (not by external pages), omit it from web_accessible_resources entirely — content scripts can always load resources from chrome.runtime.getURL() without needing external accessibility.