Google’s version of Manifest V3 limited features used by content blockers; Mozilla’s promising it’s not doing the same.
Firefox’s version 109 update, released on Tuesday, includes a new extensions system that sparked years of controversy when it was adopted for Google Chrome, due to the fact that it nerfed some ad-blockers. However, Mozilla promises that its version will still let users “access the most effective privacy tools” and ad-blockers, while still maintaining the cross-compatibility that will let developers easily port their software between browsers.
(While Google hasn’t pulled the plug on the system that lets ad-blockers operate as they have been, users do still have to deal with the threat of that happening. It’s currently unclear if Google will wind up keeping the system that’s currently letting them run.)
In a Tuesday blog post explaining the new extensions system, Mozilla says it adopted Manifest Version 3 to make things a lot easier for people developing extensions for both Chrome and Firefox. But while its implementation is largely meant to be cross-compatible, the organization says its version is different from Google’s in “some critical areas,” mainly security and privacy.
What’s a manifest?
A manifest tells the browser all sorts of information about an extension, from what its name and version number are, to what permissions it’ll use, and what versions of a browser it’ll run on. New versions of the Manifest file format used by the browsers change what features extensions have access to, and can mandate changes. For example Manifest V3 in Chrome no longer allows a developer to load code from a remote server.
Google also cited those areas when it added Manifest V3 to Chrome in 2021, calling the move “part of a shift in the philosophy behind user security and privacy.” But one of the changes in the update broke features in several popular content and ad-blocking extensions by removing a feature they used to block certain network requests (be those to trackers, advertisers, or anyone else).
I won’t go too deep into how it did that — we have an explainer that goes into the technical side of things — but the high-level takeaway is that Mozilla’s version of Manifest V3 keeps the feature Google removed, while adding support for the more limited replacement as well. That should make it so content-blocker developers don’t have to create new (and potentially more limited) versions of their extensions, while making it easier for other developers to write multi-platform extensions.
There are downsides to this approach; Mozilla itself admitted last year that there can be security risks to leaving that feature in. Apparently the foundation believes it’s worth the risk to preserve content blocking, which it called “one of the most important use cases for extensions.”
Privacy advocates like the Electronic Frontier Foundation and developers behind content-blocking extensions like Ghostery likely agree; both condemned Google’s version of Manifest V3, saying it was bad for privacy. While the extension system is in current versions of Chrome, Google has backed down a bit — late last year, the company announced it was reviewing its plans to turn off Manifest V2 support this summer, which would’ve cut off people’s access to blockers that have been avoiding the new restrictions by not switching to V3.
Still, it’s good to see that Mozilla has seemingly followed through with its promises to implement a version of Manifest V3 that allows fully-featured content blockers, while also adding many of the genuine improvements that came with Google’s version. That’s especially true given that Google can often feel like a web browsing monopoly; Chrome is the most popular browser by a long shot, and even “alternative” browsers like Microsoft Edge, Brave, and Opera are powered by its tech (though they aren’t 100 percent beholden to Google’s decisions).
Firefox 109 also introduces an extensions button, which is meant to give you a way to manage your browser add-ons from the toolbar. One of the panel’s features is that it lets you quickly see what permissions an extension has on a specific webpage, and potentially even manage them if the extension supports it.