Chrome’s Manifest V3 and Ad Blockers

In January 2023 Google Chrome is going to block extensions still using the old Manifest V2 rules. An extension manifest outlines the permissions and abilities a developer includes in an extension for Chrome browser. From Google’s perspective, Manifest V3 comes to enhance user privacy and security by:

  • Limiting extension access to user network requests.
  • Forcing authors to include all functionality within the extension, ending the practice of hosting code remotely.
  • Moving network request modifications from the extensions to the browser.
  • Replacing background pages with dedicated service workers to improve browser performance.

The unintended consequences of the new manifest is most of these limitations and restrictions break or even severely crippled the way Ad Blockers function.  AdGuard (I have never used this extension so have no first hand experience) has released an updated version of their extension which complies with the new Manifest V3. From my readings the changes and workarounds many not be so bad for the average user. However, due to limitations such as the maximum number of filters a user can have could lead to some ads (or worse malware) not being blocked for “power users”. Furthermore, since these new rules do not allow the displayed content to be changes by an add-on until after it has already been displayed may mean for users “The only thing you might notice is ad flickering due to the lag in the application of cosmetic rules,” the developer adds.

According to Google’s Manifest V2 support timeline (which have not been updated since September 2021), in January 2023 (not sure if this is January 1st or another day) the Chrome Webstore will no longer accept updates of Manifest V2 extensions AND the browser will no longer run Manifest V2 extensions. Enterprise users have a six-month grace period meaning they can continue to run Manifest V2 extensions in Chrome until June 2023 (however, the Chrome Webstore rule still applies).

Also, let’s not forget that Manifest V3 affects ALL Chrome extensions, not just Ad Blockers. This means many users could come January 1st, 2023 (or whenever in January 2023 Goggle ‘flips the switch’) wake up that morning and discover their favorite extensions no longer working as the developer has not updated to comply with Manifest V3. In Google’s defense though they announced Manifest V3 back in 2020 and the support timeline back in September 2021. I don’t see much user backlash coming from some ‘novelty’ extensions not working. User can always find another which complies with Manifest V3. Ad Blocker extensions on the other hand have a loyal user base, especially since many users heavily rely on being able to customize (filters) these extensions to fit their needs. This is where I could see a major user backlash against Goggle. The slightest friction or resistance (slow downs) to the users experience will send them running to something else (even if it this for their own good). One of the reasons ‘Pin and Chip’ at POS never really caught on in the US and why so many people despise 2FA (though having to use their personals device for work purposes is part of the reason).

If major extensions are not ready as we near the deadline Google is going to have to make a tough choice: Cut off Manifest V2 support as planned and risk losing users or delay the deadline to allow the extension developers more time to comply with Manifest V3. Where I am expecting Google to remain firm is on the rules of Manifest V3 itself.  Specifically changing the webRequest API to block extensions from modifying the data before it’s shown to the user.  While this is going to result slightly slower removal (flicker) of the ads is the cost we all have to pay for enhanced user privacy and security. These changes are badly needed as there are many nefarious/malicious  extensions out there modifying the data before it’s shown to the user (and these are not AdBlocker extensions) . Currently, these offending extensions can only be removed from the Chrome Webstore and users need to manually uninstall them from their browser. Unfortunately, this can happen after they’ve flagged by McAfee (or Google or other security firms). With Manifest V3 those type of extensions will never be allowed in the Webstore to begin with. Since they are not in Webstore users have a far lesser chance of being victimized. The only downside is it still renders ad-blockers useless.

via Bleeping Computer