The fix, in one snippet
chrome://extensions > Details > Site access > On specific sitesIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The analyser reads each content_scripts entry: matches containing <all_urls> or scheme wildcards, run_at (document_start runs before the page's own scripts), all_frames: true (injection into every iframe, including adverts and embedded login widgets), match_about_blank, and the Manifest V3 world: "MAIN" option, which runs the script in the page's own JavaScript context with access to its variables. It also looks for chrome.scripting.registerContentScripts() calls in code that register all-URL scripts dynamically. The default severity is medium; document_start plus all_frames plus the main world, or all-URL scripts combined with external endpoints, raises it. Limits: ad blockers and password managers inject everywhere for legitimate reasons, and a declaration says nothing about what the script does on a given site.
Why it matters
A content script sees the full document: card numbers in forms, messages in a mail client, tokens in the page. It can record keystrokes, alter prices or addresses, add hidden affiliate parameters, and hand anything it collects to the background script, which can send it anywhere. Running in every frame means it also sees third-party widgets such as embedded payment forms. Beyond privacy, a script in every page costs memory and load time. Users of the extension are affected on every site it matches, which here means all of them.
How to fix it
Users: restrict where the extension runs. Chrome and Edge: chrome://extensions > Details > Site access > "On click" or specific sites; this governs content scripts too. Firefox: about:addons > Permissions. Remove what you do not need.
Developers: narrow matches, use exclude_matches, avoid all_frames unless the feature needs it, and inject on demand with activeTab:
"content_scripts": [{
"matches": ["https://*.example.com/*"],
"js": ["content.js"],
"run_at": "document_idle"
}]Related: broad host permissions. Guides: are browser extensions safe? and how online tracking works.
Where this fits
Content scripts injected into every page is check 5 of 9 that the browser extension analyzer runs under extension permissions and behaviour, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Extension requests high-risk permissions (high), where the extension requests permissions that reach beyond the page: Intercepting requests, reading cookies or history, controlling downloads, talking to native programs, or debugging other tabs. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Content scripts injected into every page closes one route in. Immediately below it: Extension contacts external endpoints, where the extension's code contains addresses of external servers it communicates with, so some of your data or activity may leave the browser; Extension weakens its Content-Security-Policy, where the extension's content_security_policy loosens the default protections, permitting inline scripts, eval or remote scripts inside the extension's own pages; Extension uses Manifest V2, where the extension still declares manifest_version 2, a format Chrome no longer runs and that lacks the stricter code and policy rules of Manifest V3.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Content scripts injected into every page (medium severity)
Scanner check id: extension-content-scripts-all-urlsThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
7 min read · Updated Sep 10, 2026
Are Browser Extensions Safe? How to Audit What You Have Installed
Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...
Read the guide
8 min read · Updated Sep 02, 2026
How Online Tracking Works: Cookies, Pixels, Fingerprints and Data Brokers
Tracking is the business of linking your visits across sites into a profile. Each technique from third-party cookies to fingerprinting...
Read the guide