Content scripts injected only on domains where strictly necessary

Content scripts declared with <all_urls> or *://*/* run on every page the user visits, including banking sites, personal email, and internal tooling — even when the extension only needs to operate on one or two specific domains. ISO 25010:2011 performance-efficiency.resource-utilisation identifies this as unnecessary resource consumption: the content script consumes memory and may execute initialization code on every single page load. Beyond performance, overly broad match patterns expand the attack surface: a content script running on banking sites that has a vulnerability can be exploited in that sensitive context.

Narrow matches in manifest.json to the minimum set of domains the extension actually needs. Use document_idle injection timing unless there is a specific technical requirement for document_start.

{
  "content_scripts": [{
    "matches": ["https://github.com/*"],
    "js": ["content.js"],
    "run_at": "document_idle"
  }]
}

If the extension must support many user-chosen sites, request activeTab permission instead and inject via chrome.scripting.executeScript on button click — this eliminates the always-on content script entirely and limits injection to one tab at a time, only when the user explicitly invokes the extension.