Google Chrome will be shutting down its older, more capable extension system, Manifest V2, in favor of exclusively using the more limited Manifest V3. The deeply controversial Manifest V3 system was announced in 2019, and the full switch has been delayed a million times, but now Google says it’s really going to make the transition: As previously announced, the phase-out of older Chrome extensions is starting next week.
Google Chrome has been working toward a plan for a new, more limited extension system for a while now. Google says it created “Manifest V3” extensions with the goal of “improving the security, privacy, performance, and trustworthiness of the extension ecosystem.”
Other groups don’t agree with Google’s description, like the Electronic Frontier Foundation (EFF), which called Manifest V3 “deceitful and threatening” back when it was first announced in 2019, saying the new system “will restrict the capabilities of web extensions—especially those that are designed to monitor, modify, and compute alongside the conversation your browser has with the websites you visit.” It has a whole article out detailing how Manifest V3 won’t help security.
Comments from the Firefox team have also cast doubt on Google’s justification for Manifest V3. In a talk about the implications of Manifest V3, Philipp Kewisch, Firefox’s Add-ons operations manager, said, “for malicious add-ons, we feel for Firefox it has been on a manageable level, and since the add-ons are mostly interested in grabbing data, they can still do that with the current web request API [in Manifest V3].” Firefox plans to support Manifest V3 because Chrome is the world’s most popular browser, and it wants extensions to be cross-browser compatible, but it has no plans to turn off support for Manifest V2.
A big source of skepticism around Manifest V3 is limitations around “content filtering,” aka the APIs ad blockers and anti-tracking extensions use to fight ad companies like Google. Google, which makes about 77 percent of its revenue from advertising, has not published a serious explanation as to why Manifest V3 limits content filtering, and it’s not clear how that aligns with the goals of “improving the security, privacy, performance and trustworthiness.” Like Kewisch said, the primary goal of malicious extensions is to spy on users and slurp up data, which has nothing to do with content filtering. This is all happening while Google is building an ad system directly into Chrome, and Google properties like YouTube are making aggressive moves against ad blockers.
The initial version of Manifest V3 was detailed in 2019, and since then Google has gone back and forth with the extension community and made some concessions. Google says it raised the number of filtering rulesets allowed by Manifest V3, which should help ad blockers. One dramatic change is that filtering extensions won’t be able to update their rulesets themselves anymore, and any filtering updates would require a new version submitted to the Chrome extension store, which includes a potentially weeks-long security review. In the cat-and-mouse game of ad blockers, you can imagine how this could let YouTube change the ad system instantly, while any counterpunches from ad blockers could be delayed by weeks. Google now says it’s possible for extensions to skip the reviews process for “safe” rule set changes, but even this is limited to “static” rulesets, not more powerful “dynamic” ones.
In a comment to The Verge last year, the senior staff technologist at the EFF, Alexei Miagkov, summed up Google’s public negotiations with the extension community well, saying, “These are helpful changes, but they are tweaks to a limited-by-design system. The big problem remains the same: if extensions can’t innovate, users lose and trackers win… We now all depend on Google to keep evolving the API to keep up with advertisers and trackers.”
Google says, “over 85% of actively maintained extensions in the Chrome Web Store are running Manifest V3, and the top content filtering extensions all have Manifest V3 versions available.” The company doesn’t mention that the most popular ad blocker’s Manifest V3 version is “uBlock Origin Lite,” with the “Lite” indicating that it is inferior to the Manifest V2 version.
As for how this phase out is actually going to go, Google says next week the beta versions of Chrome will start seeing warning banners on the extensions page for any Manifest V2 extensions they have installed. V2 extensions will also lose their “featured” status in the Chrome extension store. Google says extensions will start to be disabled in “the coming months.” For a short period, users will be able to turn them back on if they visit the extension page, but Google says that “over time, this toggle will go away as well.” At that point you can either go hunting through the Chrome Store for alternatives or switch to Firefox.
https://arstechnica.com/?p=2028009