https://developer.chrome.com/apps/declare_permissions (see reference to "match pattern")
This then in turn populates the list of sites in the extension settings where you can choose to deny access to the aforementioned websites listed in the manifest
