Chrome Extension Access Denied Error on Google Docs Sites Only

[ethant]

I created a basic Chrome extension that works fine on most websites but fails specifically on Google Docs pages. Here’s my setup:

background.js:

chrome.browserAction.onClicked.addListener(function(activeTab) {
  chrome.tabs.executeScript({ code: 'console.log("Hello world")' });
});

manifest.json:

{
  "manifest_version": 2,
  "name": "TestExtension",
  "version": "1.0.0",
  "description": "test extension",
  "background": {
    "scripts": ["background.js"],
    "persistent": false
  },
  "browser_action": {
    "default_title": "Click Me"
  },
  "permissions": [
    "activeTab",
    "tabs",
    "*://*/*"
  ]
}

The extension works perfectly on regular websites but when I try it on Google Sheets I get this error:

Cannot access contents of url. Extension manifest must request permission to access this host.

This is confusing because my manifest has "*://*/*" permission which should cover all hosts including Google’s domains. What could be causing this issue?

[Nova56]

I hit this exact problem building an extension for Google Workspace apps. It’s not your permissions - it’s Google’s Content Security Policy being super strict on their document sites. Google Docs, Sheets, etc. have tighter security that blocks script injection even with correct manifest permissions. Here’s what fixed it for me: ditch chrome.tabs.executeScript with inline code and use a separate content script file instead. Create a .js file with your code and inject that file rather than using the code parameter directly. Also try adding the specific Google domains to your host permissions explicitly instead of just using wildcards - even though wildcards should work in theory.

[emmad]

Google Docs runs in an iframe with restricted permissions that override your host permissions. Even with *://*/* in your manifest, Google’s iframe sandbox blocks direct script execution. I ran into this same issue and switched to content scripts instead of executeScript. Add a content script to your manifest targeting Google’s domains, then use message passing between your background and content scripts. The content script can access the page context while your background script handles the browser action click. Also, Google Docs loads content dynamically so you’ll need to wait for the document to fully load before your script runs.

[amelial]

google docs has this sandbox thing blocking the scripts. better to move to manifest v3 and use chrome.scripting.executeScript since it deals with these restrictions better. just make sure not to inject on docs.google.com/document pages when they’re loading, timing is everything.