Google resumes transition to Manifest V3 for Chrome extensions

Original Article ↗ Hacker News Discussion ↗

Google’s move to phase out Chrome’s Manifest V2 extension model in favor of Manifest V3 is reigniting concerns that the change will weaken powerful ad blockers like uBlock Origin and shift more control over web content to the browser vendor. Commenters weigh the trade-off between improved security and privacy claims—by limiting what extensions can see and do—and the loss of flexibility for advanced blocking, customization, and user scripting. Many see this as part of a broader trend toward locking down browsers in ways that align with advertising and platform interests, prompting renewed calls to switch to alternatives like Firefox or browsers with built-in content blocking.

Perceived intent of Manifest V3

  • Many see MV3 as part of a broader effort to make the web “safe for advertising,” especially in light of YouTube’s anti–ad-block measures.
  • Some expect further moves like “browser integrity” / DRM-style mechanisms, possibly tied to Google accounts or tokens.
  • Others argue Google’s official framing (security and privacy, fewer overly‑powerful extensions) is at least partly valid, but conflict of interest is hard to ignore given Google’s ad business.

Impact on ad blocking and extensions

  • Strong concern that MV3 weakens powerful blockers (e.g., uBlock Origin) by:
    • Replacing blocking webRequest with declarativeNetRequest (DNR).
    • Reducing flexibility and making innovation dependent on browser-vendor approval.
    • Removing or limiting things like strict blocking, dynamic filtering, custom lists, and element pickers (status of each may evolve, but loss of capability is a core worry).
  • AdGuard and others say MV3 ad blocking is “usable but limited”: most filter quality can be preserved, but some features and future adaptability are lost.
  • Developers highlight concrete DNR gaps (e.g., matching redirect responses, complex URL rewrites).

Browser choice: Firefox, Brave, Chromium forks

  • Many urge switching from Chrome to Firefox, which:
    • Maintains stronger extension APIs (including blocking webRequest) and is widely viewed as the best host for uBlock Origin.
    • Has its own MV3 variant but intentionally preserves ad-block power.
  • Counterpoints:
    • Firefox has small and shrinking share; some sites (e.g., certain banks) historically blocked it or tested only against Chrome/Safari.
    • Firefox is financially dependent on Google search deals, which could be a strategic vulnerability.
  • Brave is frequently mentioned:
    • Uses a built-in Rust adblocker not based on extensions, so MV3 doesn’t affect its core blocking.
    • Plans to keep MV2 support via patches, though it still relies on Chromium upstream.

Security, privacy, and user control

  • Supporters of MV3 emphasize:
    • Reduced risk from extensions that can read all traffic or steal cookies.
    • Better-structured APIs (e.g., scripting, isolated worlds, dynamic content scripts, userScripts) and more active bug fixing.
  • Critics respond:
    • Security gains are overstated compared to the loss of user power and defensive tools.
    • MV3 centralizes control: what extensions can do is now gated by Chrome’s design and W3C processes, slowing adaptation to new tracking/abuse techniques.
    • Banning dynamic code (e.g., eval) and pushing user scripts behind “developer mode” feels like undermining the browser as a true “user agent.”

Antitrust, market power, and regulation

  • Some foresee legal or regulatory backlash if Google ever outright bans ad blockers or ties account access to ad-watching.
  • Others argue an antitrust case over MV3 specifically is unlikely: desktop-only, alternatives exist, Safari uses similar models, and most users don’t run blockers.

Workarounds and ecosystem responses

  • Proposed mitigations:
    • Network-level/content-filtering proxies (e.g., local adblock proxies).
    • DNS-based ad blocking (e.g., Mullvad’s DNS).
  • Skeptics warn Google could later push mandatory “secure DNS” or built-in “privacy VPNs” that reduce effectiveness of external blockers.
  • Some say the only principled response is to stop using hostile sites/services (including banks or Cloudflare-heavy sites) and accept reduced convenience.