Google Tightens Chrome Extension Policies Amid Security Concerns and Developer Backlash

Google has been redesigning its Chrome extension policies, a move that has wide-ranging implications for developers and users. The changes are part of Google’s effort to enhance security and privacy through its Manifest V3 (MV3) system that replaces the older Manifest V2 (MV2) system. This rollout has been incremental since 2019, with Google emphasizing that MV3 is designed to improve the performance and security of extensions by limiting their access to user data and shutting down malicious operations.
The deployment of MV3 has been attacked by ad blocker and privacy tool developers. They argue that the new framework inhibits their ability to offer effective content filtering as well as privacy features. For instance, AdGuard, arguably the most popular ad-blocking service, struggled to maintain all its functions active with MV3. The company had to turn off some of its functionality like the Quick Fixes filter and Custom filter due to MV3’s remote code execution policy designed to prevent extensions from executing malicious code.
Another affected extension is uBlock Origin, yet another extremely popular ad blocker. Due to MV3 updates, particularly the change in the webRequest API, the full version of uBlock Origin is no longer compatible with Chrome. Installation is now being blocked for it, and a message says that it doesn’t follow best practices for Chrome extensions. The developers have released an even more limited version, uBlock Origin Lite, which is MV3 compatible but lacks some of the core features.
The transition to MV3 has also been infuriating for users, with some of them thinking about jumping to alternative browsers like Firefox or Brave. Brave indicated that it would still maintain support for MV2 extensions in the meantime so that users can leverage features that have been removed from Chrome.
Google has extended the deadline to enable companies to migrate to MV3 to June 2025, thereby providing temporary relief to companies still using MV2 extensions. However, this does not alleviate the pressure on individual developers and users fighting to comprehend and adapt to the new framework.
Despite all these challenges, Google claims that MV3 is needed in order to secure the privacy and security of Chrome extensions. Google has emphasized its commitment to supporting content blockers and privacy features but the everyday usage of MV3 has left developers feeling like their interests are not being well addressed.
In addition to the technical challenges created by MV3, Google is also changing the way extensions are presented to users. For example, it is making it harder for users to pin extensions to the toolbar and highlighting site-specific permissions instead. The move is designed to give users greater control over their browsing but has been greeted with suspicion by some developers, with the counter-argument that it makes the user experience more complex rather than simpler.
Overall, Google’s efforts to solve the security and privacy of Chrome with MV3 are having a fundamental shift in the extensions’ environment. While the objective of making things secure is laudable, the execution has been criticized for falling short on meeting the needs of developers and users alike. With the deadline for full implementation of MV3 looming, developers and users are looking for improved guidance and support in effectively handling these changes.