The U.S. Criminal Code asserts the following items to fall within the special maritime and territorial jurisdiction of the United States, much of which is extraterritorial in nature:
The high seas and any other waters within the admiralty and maritime jurisdiction of the United States and out of the jurisdiction of any particular state, including any vessels owned by US persons that are travelling on them
Any US vessel travelling on the Great Lakes, connecting waters or the Saint Lawrence River (where that river forms part of the Canada–United States border)
Any lands reserved or acquired for the use of the United States, and under the exclusive or concurrent jurisdiction thereof
Any island claimed under the Guano Islands Act
Any US aircraft flying over waters in the same manner as US vessels
Any US spacecraft when in flight
Any place outside the jurisdiction of any nation with respect to an offense by or against a national of the United States
Any foreign vessel during a voyage having a scheduled departure from or arrival in the United States with respect to an offense committed by or against a national of the United States
Offenses committed by or against a national of the United States in diplomatic missions, consulates, military and other missions, together with related residences, outside the US
International Parental Kidnapping Crime Act
The US is actually pretty narrow in its assertion of extraterritorial jurisdiction and the Supreme Court has held that there is a presumption against extraterritoriality. So US laws have to explicitly assert a claim of extraterritoriality.
Contrast this with, say, France where the Code pénal asserts general jurisdiction over crimes by, or against, the country's citizens, no matter where they may have occurred.
Crimes perpetrated from foreign jurisdictions
Notwithstanding, a crime can be perpetrated in a country without the perpetrator ever having been in that country.
Hacking of computer systems is an obvious example. However, almost all criminal codes include a crime similar to "Attempted X" or "Conspiracy to commit X" which clearly don't require a physical presence. Terrorist attacks are often planned in third-party countries by a group, only a small number of whom actually go the country to commit the actual attack but all of them have committed a crime under that county's jurisdiction.
Any country (A) may request extradition from any other country (B) where A asserts that it has a case to bring against the individual. To country can demand extradition.
B will decide whether to grant the request subject to its own law on the matter and the provisions of any extradition treaty that may be in place between A and B.
A crime committed in country A may engage the jurisdiction country B. If so, country A gets first crack at prosecution. Country A might decide not to prosecute, might prosecute and fail or might prosecute and succeed. Notwithstanding the outcome country B can decide to prosecute as well. Usually if the defendant has been prosecuted by country A (win or lose), country B will not prosecute.
A specific example
An Australian engages in sex with a French-American child in the US embassy in Rome, Italy.
Italy has jurisdiction because the crime was committed in Italy. The US has jurisdiction because the offence was committed against a US national in a US diplomatic mission. France has jurisdiction because the victim was French. Australia has jurisdiction because sex crimes against minors by Australians are prosecutable in Australia.
The perpetrator flees to the UK (with whom all four countries have extradition treaties) where they are arrested - the UK government (courts and foreign minister) will decide if and to whom the perpetrator will be extradited (probably Italy). After they are prosecuted there (and serve any sentence) any of the other three may request extradition. And so on.