Can an app or extension open files on system with

Question

I thought Chrome apps were sandboxed, but I see that you can allow permissions for file:// urls, and there's a special matching pattern:

<all_urls>     Matches any URL that uses a permitted scheme. (See the beginning of this section for the list of permitted schemes.)

Are the file urls restricted to within the sandbox or can it really go anywhere?

Answer 1

Yes, you can access the entire filesystem (subject to the permissions of the user account running Chrome). However, the user must explicitly activate access to file: URLs by checking the "Allow access to file URLs" box by your extension's listing in chrome://extensions. Your extension must satisfy both requirements:

1. include the permission in the manifest (either a particular file://... match pattern or <all_urls>), and

2. have the "Allow access to file URLs" box checked by the user.

See also How to allow a Google Chrome plugin to access files as webpages.