A match pattern is a rule browser extensions use to decide which sites, pages, or URL paths a permission, content script, or message handler applies to. It acts like a filter: only requests from URLs that fit the pattern are allowed to reach the extension’s logic.
This matters because extensions often handle sensitive data such as sessions, vault content, or authentication flows. If the pattern is too broad, an untrusted site, subdomain, or embedded frame may be able to trigger privileged behavior that was meant for a trusted page. Attackers look for these mistakes to reach extension APIs, inject messages, or influence credential workflows. Defenders reduce risk by keeping match patterns as narrow as possible, avoiding wildcard coverage where it is not needed, and checking the message origin and frame context even after a URL matches.