This is fixed in manifest_version 2:

"A package's resources are no longer available by default to external websites (as the src of an image, or a script tag). If you want a website to be able to load a resource contained in your package, you'll need to explicitly whitelist it via the web_accessible_resources manifest attribute."

http://code.google.com/chrome/extensions/dev/manifestVersion...

See <http://blog.chromium.org/2012/02/more-secure-extensions-by-d...; for information about other security improvements in manifest_version 2.