The fix, in one snippet
chrome://extensions > Details > Site access > On clickIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The analyser parses manifest.json and inspects host_permissions and optional_host_permissions (Manifest V3), match patterns inside permissions (Manifest V2) and the matches arrays of every content_scripts entry. It flags <all_urls>, *://*/*, http://*/*, https://*/*, file:///* and whole-TLD wildcards such as *://*.com/*, and distinguishes permissions granted at install from those the extension can request later (see optional permissions). An extension that uses activeTab instead passes. Limits: the manifest is a declaration. A popup-only extension that requests all hosts is over-privileged rather than malicious; read this finding together with external endpoints and remote code.
Why it matters
With access to all hosts an extension can inject script into your bank and webmail, read the page (including what you type into password fields and the session tokens visible in the DOM), rewrite what you see, and with the right API permissions observe every URL you visit. Chrome states this plainly at install: "Read and change all your data on all websites". The risk is not only the original developer. Extensions are sold, and developer accounts are phished: in December 2024 the Cyberhaven extension and dozens of others were updated with cookie-stealing code after a phishing attack on their publishers' Chrome Web Store accounts. Every user of such an extension is affected on every site.
How to fix it
Users: on Chrome and Edge open chrome://extensions > Details > Site access and change "On all sites" to "On click" or a list of specific sites. On Firefox, about:addons > the extension > Permissions shows toggles for optional hosts. On Safari, Settings > Extensions lets you set each site to Ask, Allow or Deny. Remove extensions you do not use, and prefer ones that work through activeTab.
Developers: request host access at the moment it is needed rather than at install:
"permissions": ["activeTab", "scripting"],
"optional_host_permissions": ["https://*.example.com/*"]and call chrome.permissions.request() from a user gesture. Guides: are browser extensions safe? and the browser security checklist.
Where this fits
Extension can read and change data on all websites is check 2 of 9 that the browser extension analyzer runs under extension permissions and behaviour, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Extension loads or evaluates remote code (critical), where the extension fetches and executes code from a server at runtime, so what it does can change at any moment without a store review. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Extension can read and change data on all websites closes one route in. Immediately below it: Extension code is obfuscated, where the extension's JavaScript is obfuscated rather than merely minified, which hides its behaviour from reviewers and breaks the Chrome Web Store's code-readability rule; Extension requests high-risk permissions, where the extension requests permissions that reach beyond the page: Intercepting requests, reading cookies or history, controlling downloads, talking to native programs, or debugging other tabs; Content scripts injected into every page, where the extension injects its own script into every page you open, whether or not you use it there.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Extension can read and change data on all websites (high severity)
Scanner check id: extension-broad-host-permissionsThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
7 min read · Updated Sep 10, 2026
Are Browser Extensions Safe? How to Audit What You Have Installed
Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...
Read the guide
8 min read · Updated Sep 05, 2026
Is My Browser Secure? A Practical Checklist
A secure browser is up to date, enforces the web's security policies, leaks little through WebRTC and fingerprinting, and runs only...
Read the guide