Chrome 88 introduces the controversial Manifest v3 which seeks to fix the ‘extensions problem’

I’ve been covering Chrome extensions and their many mishaps for quite a while here now. Each time something crazy happens with a developer stealing user data and such, like the 15 cases of this last month, the four last week that Facebook busted, and even the popular tab suspension tool gone rogue, there’s been talk of something called “Manifest v3” which could help put an end to it all. What exactly is this Manifest v3 though, and is it the end all be all of fixes for the Chrome extensions problem? Will it have adverse effects on extensions that aren’t malicious? We’re going to demystify all of this today, so sit back, grab a drink and let’s get started.

Manifest v3 was introduced in 2018 and has a long and controversial history. Basically, it’s a new platform that makes Chrome extensions more secure, performant, and privacy-respecting by default. Primarily, it disallows remotely hosted code to be present in extensions uploaded to the Chrome Web Store which can make it easier to identify potential threats in the review process.

It also allows extensions to be updated faster thanks to a new service worker that remains present in memory only when needed, causing it to use fewer resources. Additionally, it gives users greater visibility and control over how extensions utilizing the new manifest are making use of and sharing their data. One cool trick it has is that it allows users to withhold sensitive permissions from the extensions while installing them.

In fact, the whole idea behind Manifest v3 is to provide ways for extensions to work well without needing to persistently access user data. Not only that, but Google wants to move towards a future where all extensions upgrade from Manifest v2 to v3 so that any potential performance issues with them do not affect the overall browser experience for the end-user, (Extensions that are poorly coded are known to gobble up RAM) and so that they can maintain a capable, powerful, and feature-rich platform that can be enhanced by extensions and not hindered by them.

By this point, you may be asking yourself why this looks so familiar. Well, there are two reasons, actually. First, the Google Play Store has adopted the exact same approach over the past few years. Developers are required to clearly state how they will use your data and for what purpose each permission requested of you will be used within the context of their app experience (Granular Permissions).

In Android Q, Google began allowing you to go even further and let an app only access permissions while it’s running as opposed to in the background if you so wish, and shows a persistent notification while any permission is being accessed so that you remain fully in control of your privacy from moment to moment.

Second, I’ve reported several times on how the Chrome Web Store would mimic much of this beginning in January, and well, here we are. Chrome will start giving users control over what data extensions can access, and developers who respect user privacy will receive a ‘seal of approval‘ from Google (seen below) which can help users make informed decisions about which extensions are safe to install and use. In a nutshell, Google wants to wrangle the out of control approach that the Web Store has been operating on for so many years – It feels like a free for all, and that’s unacceptable. Going forward, the Web Store extensions should closely resemble the informative and professional look of Play Store listings, and Manifest v3 is directly responsible for all of these changes.

• 

• 

Okay, let’s rope this in a bit – If Manifest v3 is so dang awesome, then why is it considered controversial? The main issue is that it requires developers like Raymond Gorhill, the trusted, awesome creator of the popular uBlock Origin and other adblockers to use a new ‘DeclarativeNetRequest’ API which will limit blocking filter entries to 30,000 among other things, which is just not even close to sufficient. In the process of limiting how many entries an extension can have in order to prevent abuse by malicious ones, Google is literally crippling the very function that allows adblockers to even exist!

Ad blockers are one of the most popular extension types, and a handful of the biggest developers in this space have gone to Google to complain – so much so that Google had to delete several of the comments on the Chromium Bug tracker and move the discussion to a private thread. In one response, a Googler stated that they had no intention of breaking extensions, but that in the process of ensuring user privacy and security, there would be a few cracked eggs no matter what.

Our goal is not to break extensions. We are working with extension developers to strive to keep this breakage to a minimum, while still advancing the platform to enhance security, privacy, and performance for all users.

Chromium Bugs

As of writing this, we’re unsure if Manifest v3 has been altered to make an exception for adblockers, and if it has, it would have to be on an individual basis according to the developer’s trust level and relationship with Google in these private discussions. uBlock Origin’s developer, Raymond, has been posting a bunch on his Twitter account about how the argument regarding the performance costs of privacy-focused browser extensions does not seem to be valid. In doing so, he has quoted an article from the ACM Digital Library discussing this. The article was written by Kevin Borgolte, and Nick Feamster, who are professors at Princeton University and the University of Chicago, respectively.

Contrary to Google’s claims that extensions which inspect and block requests negatively affect browser performance, we find that a browser with privacy-focused request-modifying extensions performs similar or better on our metrics compared to a browser without extensions. In fact, even a combination of such extensions performs no worse than a browser without any extensions. Our results highlight that privacy-focused extensions not only improve users’ privacy, but can also increase users’ browsing experience.

ACM Digital Library

Either way, Manifest v3 is basically being implemented right now with Chrome 88, so whether or not this will destroy popular adblockers as we know and love them remains to be seen. We’ll keep you posted on how this will all unfold, but as of right now, it looks like Google has created a one year migration period for them to begin using the new DeclarativeNetRequest API – leaving them to figure out a new method of working around its limitations or to cease operations. In the meantime, they will continue to support the old webRequest API of Manifest v2 extensions until that time has expired.

What are your thoughts on all of this? Do you use uBlock Origin or another adblocker? If you’re a developer, do you feel that these types of extensions slow down the browser experience? One, two, three, discuss!