> [!WARNING]
> **Warning:** You're viewing the deprecated Manifest V2 version of this article. See [Manifest V3 - Manifest Web Accessible Resources](https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources.md.txt) for the MV3 equivalent. The Chrome Web Store no longer accepts Manifest V2 extensions. Follow the [Manifest V3 Migration guide](https://developer.chrome.com/docs/extensions/develop/migrate.md.txt) to convert your extension to Manifest V3.

An array of strings specifying the paths of packaged resources that are expected to be usable in the
context of a web page. These paths are relative to the package root, and may contain wildcards. For
example, an extension that injects a content script with the intention of building up some custom
interface for `example.com` would allow any resources that interface requires (images, icons,
stylesheets, scripts, etc.) as follows:

```json
{
  ...
  "web_accessible_resources": [
    "images/*.png",
    "style/double-rainbow.css",
    "script/double-rainbow.js",
    "script/main.js",
    "templates/*"
  ],
  ...
}
```

These resources would then be available in a webpage via the URL
`chrome-extension://[PACKAGE ID]/[PATH]`, which can be generated with the [extension.getURL](https://developer.chrome.com/docs/extensions/mv2/reference/extension.md.txt#method-getURL)
method. Allowlisted resources are served with appropriate [CORS](https://www.w3.org/TR/cors/) headers, so they're available
via mechanisms like XHR.

A navigation from a web origin to an extension resource will be blocked unless the resource is
listed as web accessible. Note these corner cases:

- When an extension uses the [webRequest](https://developer.chrome.com/docs/extensions/mv2/reference/webRequest.md.txt) or [declarativeWebRequest](https://developer.chrome.com/docs/extensions/mv2/reference/declarativeWebRequest.md.txt) APIs to redirect a public resource request to a resource that is not web accessible, such request is also blocked.
- The above holds true even if the resource that is not web accessible is owned by the redirecting extension.

[Content scripts](https://developer.chrome.com/docs/extensions/mv2/content-scripts.md.txt) themselves do not need to be allowlisted.

Prior to manifest version 2 all resources within an extension could be accessed from any page on the
web. This allowed a malicious website to [fingerprint](https://en.wikipedia.org/wiki/Device_fingerprint) the extensions that a user has installed
or exploit vulnerabilities (for example [XSS bugs](https://en.wikipedia.org/wiki/Cross-site_scripting)) within installed extensions. Limiting
availability to only resources which are explicitly intended to be web accessible serves to both
minimize the available attack surface and protect the privacy of users.

## Default Availability

Resources inside of packages using [`manifest_version`](https://developer.chrome.com/docs/extensions/mv2/tabs#manifest_version) 2 or above are **blocked by default**,
and must be allowlisted for use via this property.

Resources inside of packages using `manifest_version` 1 are available by default, but *if* you do
set this property, then it will be treated as a complete list of all allowlisted resources.
Resources not listed will be blocked.