Chromium Manifest V3 Impact on Browser Extensions and User Privacy

Chromium Manifest V3 has significant implications for browser extensions and user privacy. Manifest V3 restricts extensions from accessing browser functionality, such as tabs and windows.

This change aims to reduce the risk of malicious extensions compromising user data. Manifest V3 introduces a new architecture that enforces better security and stability.

Extensions will need to be rewritten to comply with the new manifest version, which will likely cause compatibility issues. This is a significant undertaking, especially for larger extensions with complex codebases.

Users can expect improved security and stability, but may experience some inconvenience as extensions adapt to the new manifest.

Manifest V3 alters the Web Request API, moving its functionality to a new API called Declarative Net Request. This means browser extensions can no longer function as before, and popular ad blockers like uBlock Origin will stop working on Google Chrome.

The change affects the way browser extensions operate, particularly ad blockers that rely on the Web Request API to monitor traffic. This API is being replaced with the Declarative Net Request API, which has some restrictions on its functionality.

The impact of this change is already being felt, with ad-blocking extensions struggling to keep up with the new API. It's a reminder that even the most popular browser extensions can be affected by changes to the underlying technology.

Here are some key points about the changes in Chrome:

Google Chrome is introducing a new extension specification called Manifest V3, which will replace the current Manifest V2. This change affects how browser extensions operate, particularly those that rely on the Web Request API to monitor traffic and block certain web requests.

Manifest V3 restricts the old API's functionality, making it difficult for extensions like ad blockers to function as before. The leading ad-blocking extension, uBlock Origin, will no longer work on Google Chrome as a result.

The new Declarative Net Request API is being used instead of the Web Request API, but it has its own limitations. For example, it doesn't support dynamic redirects, which is a problem for extensions that rely on this feature.

Expand your knowledge: Chrome Manifest V3 Release Date

Ghostery, a popular extension that blocks trackers and cookies, is affected by these changes. Its "Enhanced Anti-Tracking" feature uses a heuristic third-party cookie blocker, but it's unclear if this will work correctly without the webRequest API.

The new API has a dynamic filter cap of 5,000 rules, which is a significant limitation for Ghostery. The extension contains 4,000 filters that detect and block trackers, but rewriting these filters to the new filter grammar offered by Chrome may result in some filters being lost.

Here are some key features of the declarativeNetRequest API that are relevant to Ghostery:

The new API also doesn't report the results of blocking back to the extension, which means that Ghostery will still have to run its filters on all URLs via the webRequest API anyway. This will result in the user paying the cost of keeping the block list loaded in memory and matching against each URL twice.

Service workers were designed to work with websites, but they don't translate well to browser extensions. This is because service workers have execution limits, shutting down shortly after performing tasks, which doesn't make sense for extensions.

Extensions need more freedom to execute code than service workers provide. Take, for example, the ability to start a separate service worker, which is broken under the new paradigm.

Manifest V3 requires all extensions to be based on service workers, which is a significant change. This means extensions are treated like accessories with limited privileges, rather than first-class applications.

This change has caused harm to many use cases, including seamlessly playing audio, parsing HTML, and requesting geolocation. These features are essential for many extensions and are now broken.

The benefits of service workers may be limited, and there are alternative ways to achieve goals like handling early termination on Android without causing so much harm.

Chrome's Manifest V3 has been a game-changer for browser extensions, but not in a good way. The initial announcement in 2018 sparked a reaction from developers, who soon realized that Manifest V3 makes extensions less useful and harder to build.

The blocking WebRequest API, which was a crucial tool for V2 ad blockers, has been replaced by the DeclarativeNetRequest API, which is inferior in many ways. This change will likely affect the efficacy of ad blockers, making them less effective for users who rely on them.

The shift from V2 background pages to service workers has also caused issues for developers. Service workers can't persist indefinitely without some ugly hacks, which can lead to problems down the line.

Here are some of the key changes that Manifest V3 has brought:

This change has left the extension developer community feeling frustrated and has led to a backlash against Chrome's vision for Manifest V3.

Removing webRequest blocking will significantly impact user privacy, as it affects the functionality of extensions like Ghostery. One major consequence is the loss of up to 30,000 static rules per extension, which were previously used to block unwanted tracking.

Ghostery's ability to dynamically whitelist individual sites will also be severely limited, with a maximum of 100 sites allowed per extension. This means users will have less control over which sites are tracked.

The impact on user privacy will be felt most acutely in the realm of data collection, as extensions like Ghostery will no longer be able to block or modify tracking requests. This could lead to a significant increase in the amount of data collected by websites and advertisers.

Curious to learn more? Check out: Chrome Extension Manifest V3

Extension Privacy is a growing concern for users. Many extensions have access to sensitive user data, including browsing history and login credentials.

Some extensions, like ad blockers, only collect data on the sites they're blocking. However, others, like social media extensions, can share user data with third-party companies.

Extensions can also be used to track user behavior, such as how long they spend on a particular website or what links they click on. This data can be used to create targeted ads.

Some users may not realize that extensions can collect their data, and may not be aware of the permissions they're granting when they install an extension. This lack of transparency can be a major issue.

The Chrome Web Store has implemented policies to regulate extension data collection, but more needs to be done to protect user privacy.

Removing webRequest blocking in Ghostery will have a significant impact on user privacy. The extension relies heavily on this functionality to detect and block trackers, with a blocklist of over 4,000 filters that can be fine-tuned by users.

Ghostery's rich configurability will be severely limited, as the new declarativeNetRequest API only allows for up to 5,000 dynamic rules, far short of the 4,000 filters currently in use. This means that users will lose some of the fine-grained control they currently have over tracker blocking.

The new API also restricts the ability to add dynamic rules at runtime, which will make it difficult for Ghostery to implement features like adblocking and cookie blocking. The limit of 100 whitelisted sites is another concern, as many users may need to trust more sites than this.

The declarativeNetRequest API does not report the results of blocking back to the extension, so Ghostery will still need to run its filters on all URLs via the webRequest API, doubling the processing load and impacting performance.

Here's a comparison of the old and new APIs:

Cookie blocking will also be affected, as the new API does not support dynamic redirects, making it difficult to block cookies in certain situations. The heuristic third-party cookie blocker will need to be reworked to accommodate the new API, potentially introducing new issues like race conditions.

Chrome has introduced several new features that make it easier to manage extensions and improve user experience.

One of the notable features is the ability to declaratively specify permissions for extensions, which is a major shift from the previous approach of relying on runtime permissions.

With this change, developers can now specify the exact permissions needed by their extensions, making it easier for users to understand what access their extensions have.

This new approach also allows for more precise control over permissions, reducing the risk of malicious extensions accessing sensitive data.

The new features also include improved support for Manifest V3, which enables developers to create extensions that are more secure and efficient.

Manifest V3 introduces a new architecture for extensions, which includes a more robust and secure way of handling permissions and data.

This new architecture is designed to improve performance and reduce the risk of security vulnerabilities.

Chrome has also introduced a new API for extensions, which provides a more standardized way of interacting with the browser.

This API is designed to be more flexible and easier to use, making it simpler for developers to create extensions that work seamlessly with the browser.

The new API also includes improved support for web requests, which allows developers to create extensions that can handle complex web interactions.

Overall, these new features and APIs are designed to make it easier for developers to create extensions that are secure, efficient, and provide a better user experience.