Chrome Extension Manifest V3: A Complete Guide

Manifest V3 is a significant update to the Chrome extension architecture, introducing several key changes that impact how extensions are developed and interact with the browser.

The primary goal of Manifest V3 is to improve security and performance, which is achieved by restricting certain APIs and introducing new ones.

One of the most notable changes in Manifest V3 is the deprecation of the webRequest API, which was used to intercept and modify HTTP requests.

This change is a result of the browser's increased focus on security and user privacy, and is intended to prevent malicious extensions from accessing sensitive user data.

You can set up a Chrome extension right now within a couple of minutes. It won't be able to do anything of course, but it's a great starting point.

A few weeks ago, I got curious about how to create my own Chrome extension and started working on creating my own extension. I wrote about how I go about approaching that project here if you want to check it out.

One thing to keep in mind is that Chrome migrated to the v3 manifest, whereas older tutorials might still be using v2. Although they are very similar, there are a few distinctions to navigate.

Here are the key areas to focus on when getting started:

These areas will give you a solid foundation for understanding how to create and develop your own Chrome extension using the v3 manifest.

Manifest V3 is a significant update to the Chrome extension specification, and it's essential to understand its key features. Service workers replace background pages in Manifest V3, allowing for more efficient and secure extension functionality.

One of the primary changes is the replacement of the Web Request API with the Declarative Net Request API. This means that extensions can no longer use the old API to monitor traffic and block certain web requests.

The Declarative Net Request API is a more secure and privacy-focused approach, but it also restricts some of the old API's previous functionality. This change affects many browser extensions, including ad blockers like uBlock Origin.

Expand your knowledge: Chrome Devtools Replay Request

Here are the key differences between Manifest V2 and V3:

Manifest V3 introduces a new extension anatomy that's quite different from the old one. This change is driven by the need to improve security and performance.

The new extension anatomy is centered around the concept of a single, self-contained file called the manifest file. This file contains all the necessary metadata and permissions for the extension.

A key feature of Manifest V3 is the use of a new type of content script, called a declarativeContent script. This type of script allows for more granular control over content injection.

DeclarativeContent scripts are executed on the background script, which is a separate process from the content script. This separation improves security and reduces the risk of content injection attacks.

The background script is responsible for managing the extension's state and handling events. It's also where you'll find the new declarativeContent scripts.

DeclarativeContent scripts are defined using a specific syntax and structure, which is different from the old content script approach. This new syntax allows for more flexibility and customization.

The manifest file also contains a new section called permissions. This section lists the specific permissions required by the extension, such as access to web pages or storage.

Curious to learn more? Check out: New Domain Extension

Manifest V3 is a significant upgrade from Manifest V2, and understanding the key differences is crucial for extension developers. Service workers replace background pages in Manifest V3, which is a fundamental shift in how extensions operate.

One of the most notable changes is the way network request modification is handled. In Manifest V3, extensions use the declarativeNetRequest API to modify network requests, which is a more declarative and less invasive approach.

Background pages are no longer used in Manifest V3, which means that extensions can't rely on them as they did in Manifest V2. This change requires developers to rethink their extension's architecture and how it interacts with the browser.

Extensions in Manifest V3 can only execute JavaScript that's included within their package and can't use remotely-hosted code. This change helps improve security and prevents malicious code from being injected into the browser.

Many methods in Manifest V3 now support promises, which makes coding more efficient and easier to read. Callbacks are still supported as an alternative, but promises are the recommended approach.

Host permissions in Manifest V3 are a separate element and must be specified in the "host_permissions" field. This change makes it easier to manage permissions and ensures that extensions only have access to the resources they need.

The content security policy in Manifest V3 is an object with members representing alternative content security policy (CSP) contexts. This change provides more flexibility and allows developers to configure CSP more granularly.

You might enjoy: How to Test Html Code in Chrome

To update your Chrome extension, you'll need to modify the version number in the manifest.json file, which is the metadata file that Chrome uses to understand your extension's functionality.

Make sure to update the version number in the manifest.json file to reflect the changes you've made to your extension.

When updating your extension, it's essential to test it thoroughly to ensure that the changes you've made don't break any existing functionality.

For another approach, see: Extension Number

Updating your manifest's basic structure is a crucial step in transitioning to Manifest V3. You'll need to change the value of the "manifest_version" element to 3 to determine that you're using the Manifest V3 feature set.

The most important change you'll need to make is updating the "manifest_version" element to 3. This is the first step in transitioning to Manifest V3.

In Manifest V3, background pages are replaced with a single extension service worker. You'll need to register the service worker under the "background" field, using the "service_worker" key and specifying a single JavaScript file.

You can optionally declare the service worker as an ES Module by specifying "type": "module", which allows you to import further code. This is a useful feature, but it's not required.

The "browser_action" and "page_action" properties are unified into a single "action" property in Manifest V3. You'll need to replace these properties with "action" in your manifest.

Similarly, the "chrome.browserAction" and "chrome.pageAction" APIs are unified into a single “Action” API in Manifest V3. You'll need to migrate to this API to take advantage of the new features and changes introduced in Manifest V3.

Check this out: Chrome Inspect Element Extension

Updating your extension's content security policy is a crucial step in making it compliant with Manifest V3. In Manifest V2, the CSP was specified as a string in the "content_security_policy" field of the manifest.

You'll need to make changes to your manifest file to update the CSP. Instead of a single "content_security_policy" field, you'll now have to specify separate fields for "content_security_policy.extension_pages" and "content_security_policy.sandbox".

Remove any references to external domains in the "script-src", "worker-src", "object-src", and "style-src" directives. This is especially important if they are present.

To ensure the security and stability of your extension, make these updates to your CSP.

Curious to learn more? Check out: Chrome Manifest V3 Release Date

To use the new declarativeNetRequest API, you'll need to specify the declarativeNetRequest permission in your manifest.

Google is phasing out the chrome.webRequest API, which was used to modify network requests in Manifest V2, in favor of the declarativeNetRequest API.

You'll need to update your code to use the declarativeNetRequest API instead of the chrome.webRequest API.

Expand your knowledge: How to Use Chrome Extension Html to Pdf Converter

The declarativeNetRequest API requires you to specify a list of predetermined addresses to block, rather than being able to block entire categories of HTTP requests.

To ensure your extension continues to function properly under Manifest V3, you must make these changes in your code.

Here's an example of how to modify your manifest to use the declarativeNetRequest API in Manifest V3: specify the declarativeNetRequest permission in your manifest.

You might like: How Do You Block a Website on Google Chrome

The transition to Manifest V3 is a significant change that Chrome extension developers need to be aware of. The transition has been ongoing since 2018 and will officially begin rolling out in January 2023.

Here's a summary of key milestones in the transition to Manifest V3:

To smoothly transition to Manifest V3, focus on updating your extension's basic structure, modifying host permissions, updating the content security policy, and modifying network request handling.

The transition to Manifest V3 is a major undertaking, but it's essential to get it right. Support for Manifest V2 extensions will be turned off in Chrome's Canary, Dev, and Beta channels in January 2023.

You'll want to start preparing your extensions for Manifest V3 as soon as possible. By June 2023, extensions that run Manifest V2 will no longer be available on the Chrome Web Store.

To ensure a smooth transition, focus on updating your extension's basic structure, modifying host permissions, updating the content security policy, and modifying network request handling. These four key areas will get your Chrome Extension well on the right track for the eventual transition.

Here's a brief overview of what you can expect during the transition:

Extensions that do not comply with the new rules introduced in Manifest V3 will eventually be removed from the Chrome Web Store. So, it's crucial to update your extensions to Manifest V3 before it's too late.

As the Manifest V3 update rolls out, it's time to consider leaving Google Chrome behind. Many users have already made the switch to Mozilla Firefox, which still supports the Web Request API and associated apps.

Firefox is a great option for those who want to stick with a Chromium-based browser. 93 percent of Chrome extensions are already Manifest V3-compliant, making it easier to transition.

However, some users may be hesitant to give up their favorite extensions. Fortunately, a Manifest V3-compliant version of uBlock Origin, called uBlock Origin Lite, is available. It's not as powerful as the original, but it's a good starting point.

If you're not ready to switch to a new browser, some Chromium-based browsers have said they'll continue to support V2 Manifest apps for as long as possible. Brave Browser is one example, although their plans were announced in 2022.

Ultimately, the decision to leave Chrome is up to you. But with 93 percent of extensions already compliant, it's not as daunting a task as it once was.

Google is officially moving to Manifest V3, its updated Chrome extension specification, which will affect how browser extensions operate.

Manifest V3 alters the Web Request API, moving its functionality to a new API called Declarative Net Request.

This change restricts some of the old API's previous functionality, meaning browser extensions can no longer function as before.

Google claims Manifest V3 will bolster the "security, privacy, performance and trustworthiness of the extension ecosystem as a whole."

The leading ad-blocking extension, uBlock Origin, among others, will stop working on Google Chrome due to this change.

A fresh viewpoint: Change Devtools Language Chrome