Say that file: access requires user opt-in.

chrome/common/extensions/docs/static/match_patterns.html

 <div id="pageData-name" class="pageData">Match Patterns</div>
 
 <p>
 <a href="content_scripts.html">Content scripts</a> operate on
 a set of URLs defined by match patterns.
 You can put one or more match patterns
 in the <code>"matches"</code> part of
 a content script's section of the manifest.
 This page describes the match pattern syntax &mdash;
 the rules you need to follow when you specify
 which URLs your content script affects.
 </p>
 
 <p>
 A match pattern is essentially a URL
 that begins with a permitted scheme (<code>http</code>,
 <code>https</code>, <code>file</code>, or <code>ftp</code>),
 and that can contain '<code>*</code>' characters.
 The special pattern
 <code>&lt;all_urls&gt;</code> matches any URL
 that starts with a permitted scheme.
 Each match pattern has 3 parts:</p>
 </p>
 
 <ul>
   <li> <em>scheme</em> &mdash;
     for example, <code>http</code> or <code>file</code>
     or <code>*</code>
+    <p class="note">
+    <b>Note:</b>
+    Access to <code>file</code> URLs isn't automatic.
+    The user must visit the extensions management page
+    and opt in to <code>file</code> access for each extension that requests it.
+    </p>
   </li>
   <li> <em>host</em> &mdash;
     for example, <code>www.google.com</code>
     or <code>*.google.com</code>
     or <code>*</code>;
     if the scheme is <code>file</code>,
     there is no <em>host</em> part
   </li>
   <li> <em>path</em> &mdash;
     for example, <code>/*</code>, <code>/foo* </code>,
@@ skipping 90 matching lines @@
   <td>
     http://example.org/foo/bar.html
   </td>
 </tr>
 
 <tr>
   <td>
     <code>file:///foo*</code>
   </td>
 
-  <td>Matches any local file whose path starts with <code>/foo</code></td>
+  <td>Matches any local file whose path starts with <code>/foo</code>
+  </td>
 
   <td>
     file:///foo/bar.html<br>
     file:///foo
   </td>
 </tr>
 
 <tr>
   <td>
     <code>http://127.0.0.1/*</code>
@@ skipping 75 matching lines @@
   <td>Missing <em>scheme</em> separator ("/" should be "//")</td>
 </tr>
 
 <tr>
   <td><code>foo://*</code></td>
   <td>Invalid <em>scheme</em></td>
 </tr>
 </tbody>
 </table>