Manifest V3's limits: a security feature or a functional downgrade for ad blockers?

A new academic paper quantifies the impact of Google's Manifest V3 on ad blockers, reigniting the debate over whether the changes prioritize user security or cripple a key extension category.

Where it happened

The debate is anchored by a pre-print academic paper posted to arXiv in March 2025, titled “An Empirical Study of the Impact of Manifest V3 on the Ad-Blocking Ecosystem.” The paper, from researchers at the University of Lorraine, provides a quantitative analysis of a long-simmering conflict between Google and the developers of privacy-focused browser extensions. The paper itself serves as a formal, data-driven counterpoint to Google's publicly stated rationale for its browser extension platform changes.

Side A: The platform steward

Google’s position is that Manifest V3 is a necessary evolution for the security, privacy, and performance of the Chrome extension ecosystem. Proponents of the change, primarily Google engineers and developer advocates, argue the old Manifest V2 system, which relied on the webRequest API, was too permissive. It allowed extensions to intercept, read, and modify all of a user's network traffic in real time. While powerful, this created significant security vulnerabilities; a single malicious extension could act as a potent man-in-the-middle, harvesting sensitive data like passwords and session cookies.

Manifest V3 replaces this with the declarativeNetRequest API. This API requires developers to provide a predefined list of rules to the browser. The browser then handles the blocking logic itself, without the extension ever seeing the content of the network requests. Google argues this approach is inherently more secure and performant, as the filtering logic is handled by the browser's native code. The controversial limits on the number of rules are presented as a necessary tradeoff to maintain browser performance and prevent abuse.

Side B: The empirical analysis

The paper’s authors, along with developers of popular ad blockers like uBlock Origin and AdGuard, argue that Manifest V3’s limitations constitute a functional downgrade that harms user privacy. Their core argument is that the declarativeNetRequest API is not powerful enough to replicate the complex filtering logic of modern ad blockers. The primary constraint is the limited number of rules an extension can use, which is far lower than the number of rules contained in popular community-maintained filter lists like EasyList.

The researchers' analysis provides data to support this claim. They tested top ad blockers under simulated MV3 conditions against the 10,000 most popular websites. Their findings, as stated in the paper, show “a statistically significant degradation in blocking performance, with an average of 18% more ad-related requests successfully completing under Manifest V3's rule constraints.” This side argues that while security is a valid goal, the specific limits chosen by Google effectively cripple the most effective ad and tracker blockers, leaving users less protected than they were before.

What's underneath

This is a debate about platform control, framed as a technical discussion about security. Google is centralizing a critical function (network request filtering) inside the browser, removing power and flexibility from third-party developers under the banner of user safety. Extension developers, in turn, see this as a move by a platform owner with a vested interest in advertising to weaken a technology that directly threatens its primary business model. The conflict is less about whether security is important and more about who is trusted to provide it: the platform owner or the ecosystem of independent developers. The paper introduces empirical data into a debate that was previously dominated by technical and philosophical arguments.

The investor read

The Manifest V3 debate is a clear signal of platform risk for any business built on the Chrome extension ecosystem. It demonstrates a platform owner's ability to unilaterally deprecate core APIs, potentially rendering entire product categories less effective or obsolete. For investors, this highlights the critical need for due diligence on platform dependency and the potential for a single company's policy changes to reshape a market. It also creates a potential, if small, market opportunity for competing browsers like Firefox or Safari to attract developers and privacy-conscious users by maintaining more powerful extension APIs.