Users of Google’s Chrome browser will find it harder to block ads and trackers from next June, after the company revived the on-again, off-again upgrade of its controversial browser extension framework whose tight limits threaten to disempower ad blocking tools.
The changes – which were outlined in a recent Google blog for developers – will come as a major upgrade to Manifest, the set of application programming interfaces (APIs) that allow third-party developers to build extensions that run in Chrome and other browsers built on Google’s open-source Chromium platform.
Extensions using the current Manifest V2 (MV2) have been available for years, but in late 2019 Google introduced MV3 to improve the privacy, security and performance of browser extensions with changes such as limiting the number of computer resources that extensions can consume; preventing extensions from accessing unvetted code that is hosted on other servers; and limiting direct network access.
MV3 also replaces a feature called ‘background pages’ – a technique that enables extensions to watch what you’re doing in your browser across web sites – with a new feature called ‘service workers’, which are tightly controlled scripts that keep running in the background even as you move between websites.
Such tools are critically important to tools such as ad blockers, which rely on Manifest to actively check and block website calls to particular advertising and tracking sites.
Makers of ad blockers quickly found that MV3 restrictions – such as an arbitrary cap on the number of ad-blocking rules that could run simultaneously – prevented their apps from working as effectively in the past, spawning an industry-wide uproar that forced the company to repeatedly delay the transition to MV3, which was originally planned to see new MV2 extensions blocked in January 2022 and all such extensions disabled in June this year.
Late last year, Google put those plans on ice and went back to the drawing board, working with developers to find common ground around MV3 – and did so again in April, when it said it was still figuring out the best way to roll out MV2.
Seven months later, the transition is back on again, according to a new Google blog post that now says from June 2024 users will be unable to install MV2 extensions – and that currently installed MV2 extensions will be disabled as Google “gradually roll out the change”.
Enterprise users will have an extra year to migrate away from MV2 versions of any extensions they rely upon.
Better performance or privacy nightmare?
MV3’s potential to restrict privacy-protecting tools sparked a backlash so fierce that the Electronic Frontier Foundation (EFF) called MV3 “deceitful and threatening” and warned that its changes were “outright harmful to privacy efforts”.
Despite Google’s insistence that the changes were to benefit users, the privacy-focused EFF argued that the restrictions it placed on MV3 were “paternalistic and downright creepy” – citing developer concerns that Chrome was being twisted into a service primarily intended to steer users towards using Google services.
Given that Google’s business model is based on advertising revenue, its efforts to restrict ad blockers surprised nobody – particularly in the context of more recent, and more explicit, moves to force YouTube users to stop using ad blockers.
Google has stuck with its party line that the changes in MV3 are about improving performance – which has been a problem in the past when some badly-behaved extensions consume more browser resources than they should – but discussions with developers have seen it make concessions such as increasing the originally proposed limit of 5000 declarative net request (DNR) rules per extension to 30,000 rules.
Given that a robust ad and content blocker like the open-source uBlock Origin requires around 300,000 DNR rules to keep up with the flood of new trackers and advertising links buried in most websites, the new limits will severely limit its functionality and push MV3 users to use the stripped-down uBlock Origin Lite, which only requires 17,000 rules.
Although rival browser makers will inevitably support MV3 for compatibility reasons, Firefox maker Mozilla, for one, has already said that its implementation of MV3 will not impose filtering limits because “our principles call for a different course of action [including] uniquely improved privacy and security safeguards.”
Widely used ad blocker AdGuard, for one, has welcomed Mozilla’s strategy and remains sceptical of changes that, it argues, exploit a public that is already concerned about their lack of control over their privacy and the data collected about them.
As well as actively working around YouTube’s new anti ad-blocker technologies, AdGuard has been reworking its tools to function within MV3’s limits – with “good filtering quality”, as co-founder and CTO Andrej Meshkov recently reported.
“We haven’t finished our work yet, but there is light at the end of the tunnel.”