tech, developers, and the code underneath

issue 010· news·

Chrome finishes off Manifest V2

The extension platform migration everyone fought about for six years reaches its end state.

Chrome has begun disabling remaining Manifest V2 extensions on the stable channel. Users are seeing them turned off with a notice suggesting alternatives. Enterprise policy can delay this, but only for a while.

This has been announced, delayed, re-announced and re-delayed since 2019. It is now happening.

the technical core of the fight#

MV2 gave extensions the webRequest API with blocking behavior: an extension could intercept a network request, run arbitrary JavaScript, and decide what to do. That is enormously powerful and enormously flexible.

MV3 replaces it with declarativeNetRequest: the extension registers rules ahead of time, and the browser evaluates them. The extension never sees the request.

Google's argument is performance, privacy and security: an extension that cannot see your requests cannot exfiltrate them, and rules evaluated in browser code are faster than a round trip into an extension's JavaScript context. All of that is genuinely true.

The counter-argument is capability. Content blocking that requires dynamic decisions — matching on response bodies, generating rules from observed traffic, handling sites that actively rotate their ad-serving domains — is harder or impossible under a declarative model. The rule count limits, though raised several times under pressure, are still limits.

where it actually lands#

uBlock Origin's MV3 version, uBlock Origin Lite, works well for most users and is meaningfully less capable in the tail. Its author has been consistent and unusually clear-eyed about this: Lite is not Origin, it is a different product with a different capability envelope, and calling it a drop-in replacement would be dishonest.

For most people the difference will be invisible. For the people who notice, the difference is the whole point.

the part that is actually about power#

It is possible to believe all of the following simultaneously:

  • MV3's security model is a real improvement.
  • The declarative approach is the right architecture for most extensions.
  • A company whose revenue is advertising should not be the sole arbiter of what ad-blocking extensions can do in the browser used by most of the world.

The third one is not a technical claim and cannot be resolved with a benchmark. It is a structural conflict of interest, and it will keep producing this exact argument every time Chrome makes a platform decision, regardless of the merits of that specific decision.

what to do#

Firefox supports MV3 but kept blocking webRequest, which means full-featured content blockers still work there. Safari has its own model. If content blocking is load-bearing for you, that is now a browser choice, not an extension choice.

For extension developers: the migration is done, stop hedging, port it. The compatibility shims are worse than a real rewrite and you will maintain them forever.

For everyone else: this is a useful reminder that "the web platform" is a set of decisions made by a handful of engineering organizations, and the parts you rely on are only as durable as their continued interest in supporting them.

Dom, February 7, 2025

get README in your inbox

One dispatch, no noise. Tech and developer news, plus the occasional long piece on the craft.

subscribe →