| Both sides previous revisionPrevious revision | |
| privacy:browser_extensions [2026/09/22 07:48] – Generic (fable) review pass 5 applied: Double-Edged Shield is fingerprintability not one of the eleven blocking-efficacy papers; needle count 64->66; Carnus row names the two vectors Carnus introduces and drops its own changelog; snapshot-date figure 51.4 karel.kubicek.claude | privacy:browser_extensions [2026/09/22 19:01] (current) – Manifest V2 milestone quotes re-fetched: Chrome reworded the timeline after 2026-09-02 ('are removed' -> 'have been removed'; the installed-copies sentence rewritten) and moved its footer to 2026-09-09. Three quote sites and the footnote updated; external karel.kubicek.claude |
|---|
| * **There is no listing API.** The "Chrome Web Store API" publishes and manages //your own// item. The only enumeration Google publishes is an XML sitemap at ''%%https://chromewebstore.google.com/sitemap%%'', which on this date carried **42 shards** (''lastmod'' 2026-09-01) and **356,984 distinct item IDs**. Those are //items//, not extensions: unpacking the CRX for a deterministic 200-item sample gives **146 extensions, 44 themes and 8 legacy Chrome apps** (198 served; the endpoint declined 2), and a separate 40-item sample, taken from the same list on the same day, found **2 IDs with no live detail page**. | * **There is no listing API.** The "Chrome Web Store API" publishes and manages //your own// item. The only enumeration Google publishes is an XML sitemap at ''%%https://chromewebstore.google.com/sitemap%%'', which on this date carried **42 shards** (''lastmod'' 2026-09-01) and **356,984 distinct item IDs**. Those are //items//, not extensions: unpacking the CRX for a deterministic 200-item sample gives **146 extensions, 44 themes and 8 legacy Chrome apps** (198 served; the endpoint declined 2), and a separate 40-item sample, taken from the same list on the same day, found **2 IDs with no live detail page**. |
| * **HTTP 200 is not existence.** ''%%/detail/<id>%%'' returns **200 for an ID that does not exist**, because the store is a single-page app that renders a generic shell. The signal that does work is the ''%%<title>%%'': a live item is titled //"Name - Chrome Web Store"//, a missing one is titled exactly //"Chrome Web Store"//. A status-code check admits every delisted extension in your seed list. | * **HTTP 200 is not existence.** ''%%/detail/<id>%%'' returns **200 for an ID that does not exist**, because the store is a single-page app that renders a generic shell. The signal that does work is the ''%%<title>%%'': a live item is titled //"Name - Chrome Web Store"//, a missing one is titled exactly //"Chrome Web Store"//. A status-code check admits every delisted extension in your seed list. |
| * **Manifest V2 is gone, and it went two days ago.** Chrome's own timeline records **2026-08-31: "All remaining Manifest V2 extensions are removed from the Chrome Web Store"**. uBlock Origin (''cjpalhdlnbpafiamejdnhcphjbkeiagm'') is no longer in the sitemap and its detail page is now a soft-404; uBlock Origin Lite (MV3) is still there. Any seed list, any replication, any "top extensions" sample older than that is measuring a store that no longer exists. | * **Manifest V2 is gone, and it went two days ago.** Chrome's own timeline records **2026-08-31: "All remaining Manifest V2 extensions have been removed from the Chrome Web Store"**. uBlock Origin (''cjpalhdlnbpafiamejdnhcphjbkeiagm'') is no longer in the sitemap and its detail page is now a soft-404; uBlock Origin Lite (MV3) is still there. Any seed list, any replication, any "top extensions" sample older than that is measuring a store that no longer exists. |
| * **The CRX endpoint fails silently.** ''%%clients2.google.com/service/update2/crx%%'' still serves packed extensions, but returns **204 No Content with an empty body** when ''prodversion'' is not a plausible four-part Chrome version. Passing ''120.0'' — the form in most tutorials — produces an empty corpus that looks like a network fault. | * **The CRX endpoint fails silently.** ''%%clients2.google.com/service/update2/crx%%'' still serves packed extensions, but returns **204 No Content with an empty body** when ''prodversion'' is not a plausible four-part Chrome version. Passing ''120.0'' — the form in most tutorials — produces an empty corpus that looks like a network fault. |
| |
| Only **11** of the 68 in-scope papers name Manifest V3 at all — the earliest in 2020, and seven of the eleven from 2024 onwards. Every //Chrome// result older than those is a result about Manifest V2 or the extension model before it, and neither platform still exists in Chrome. The Firefox and Opera corpora above were never Manifest V2 in Chrome's sense at all. | Only **11** of the 68 in-scope papers name Manifest V3 at all — the earliest in 2020, and seven of the eleven from 2024 onwards. Every //Chrome// result older than those is a result about Manifest V2 or the extension model before it, and neither platform still exists in Chrome. The Firefox and Opera corpora above were never Manifest V2 in Chrome's sense at all. |
| |
| ^ Date ^ Milestone, from Chrome's own timeline((Chrome for Developers, [[https://developer.chrome.com/docs/extensions/develop/migrate/mv2-deprecation-timeline|"Manifest V2 support timeline"]], page footer "Last updated 2026-07-08 UTC", fetched 2026-09-02. Every quoted phrase in this table is verbatim from it.)) ^ | ^ Date ^ Milestone, from Chrome's own timeline((Chrome for Developers, [[https://developer.chrome.com/docs/extensions/develop/migrate/mv2-deprecation-timeline|"Manifest V2 support timeline"]], page footer "Last updated 2026-09-09 UTC", re-fetched 2026-09-22. Every quoted phrase in this table is verbatim from it, and ''scripts/external_checks_browser_extensions.sh'' check 8 now fails the run if any of them stops being. Google reworded the 2026-08-31 entry after the 2026-09-02 fetch — //"are removed"// became //"have been removed"//, and the installed-copies sentence was rewritten — so the wording quoted here is the 2026-09-22 wording; the earlier one is in the Internet Archive capture of 2026-09-01.)) ^ |
| | January 2022 | the Chrome Web Store stops accepting new public Manifest V2 extensions | | | January 2022 | the Chrome Web Store stops accepting new public Manifest V2 extensions | |
| | June 2024 | Manifest V2 extensions //"lose their badge"// — the Featured badge is withdrawn | | | June 2024 | Manifest V2 extensions //"lose their badge"// — the Featured badge is withdrawn | |
| | 2025-03-31 | MV2 disabled by default, users may re-enable; enterprises exempt via ''ExtensionManifestV2Availability'' | | | 2025-03-31 | MV2 disabled by default, users may re-enable; enterprises exempt via ''ExtensionManifestV2Availability'' | |
| | **2025-07-24** | //"With Chrome 138 all users on all channels of Chrome have now Manifest V2 extensions disabled. Users can no longer turn them back on."// The enterprise policy is //"removed with Chrome 139"// | | | **2025-07-24** | //"With Chrome 138 all users on all channels of Chrome have now Manifest V2 extensions disabled. Users can no longer turn them back on."// The enterprise policy is //"removed with Chrome 139"// | |
| | **2026-08-31** | //"All remaining Manifest V2 extensions are removed from the Chrome Web Store."// Installed copies on Chrome 138 or earlier //"will remain installed, but will be unable to receive any updates and cannot be reinstalled"// | | | **2026-08-31** | //"All remaining Manifest V2 extensions have been removed from the Chrome Web Store."// //"Existing installs on Chrome 138 or earlier will continue to run, but they can no longer receive updates or be reinstalled if removed."// | |
| |
| The other browsers did not follow. **Firefox supports both**, and keeps blocking ''webRequest'': MDN documents ''webRequestBlocking'' as an ordinary API permission with no Manifest V3 restriction((Compare [[https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest|MDN's ''webRequest'']] — //"To use the 'blocking' feature, the extension must also have the 'webRequestBlocking' API permission"// — with [[https://developer.chrome.com/docs/extensions/reference/api/webRequest|Chrome's]] — //"As of Manifest V3, this is only available to policy installed extensions."// Both fetched 2026-09-02.)). **Microsoft Edge has not set a date**: its own policy documentation says //"the timeline of the migration hasn't been established"//((Microsoft Learn, [[https://learn.microsoft.com/en-us/deployedge/microsoft-edge-browser-policies/extensionmanifestv2availability|''ExtensionManifestV2Availability'']], fetched 2026-09-02.)). So a cross-browser extension study in 2026 is comparing two different extension platforms, and has to say which. | The other browsers did not follow. **Firefox supports both**, and keeps blocking ''webRequest'': MDN documents ''webRequestBlocking'' as an ordinary API permission with no Manifest V3 restriction((Compare [[https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest|MDN's ''webRequest'']] — //"To use the 'blocking' feature, the extension must also have the 'webRequestBlocking' API permission"// — with [[https://developer.chrome.com/docs/extensions/reference/api/webRequest|Chrome's]] — //"As of Manifest V3, this is only available to policy installed extensions."// Both fetched 2026-09-02.)). **Microsoft Edge has not set a date**: its own policy documentation says //"the timeline of the migration hasn't been established"//((Microsoft Learn, [[https://learn.microsoft.com/en-us/deployedge/microsoft-edge-browser-policies/extensionmanifestv2availability|''ExtensionManifestV2Availability'']], fetched 2026-09-02.)). So a cross-browser extension study in 2026 is comparing two different extension platforms, and has to say which. |
| * **HTTP 200 from a store detail page is not existence.** See the box at the top. | * **HTTP 200 from a store detail page is not existence.** See the box at the top. |
| * **The CRX endpoint's 204 is indistinguishable from a refusal.** Fail loudly on it; do not treat an empty body as "no such extension". | * **The CRX endpoint's 204 is indistinguishable from a refusal.** Fail loudly on it; do not treat an empty body as "no such extension". |
| * **A delisted extension is still installed on millions of machines.** The store is the supply, not the population. Chrome's own timeline says removed MV2 extensions //"will remain installed"//. A store-only study measures availability, not exposure. | * **A delisted extension is still installed on millions of machines.** The store is the supply, not the population. Chrome's own timeline says existing installs of removed MV2 extensions //"will continue to run"//. A store-only study measures availability, not exposure. |
| * **The extension you download is not the extension the user runs.** Update deltas are where malice arrives {[pantelaios2020_changed]}, and the December 2024 Cyberhaven compromise is the worked example: a phishing attack on a developer's Web Store credentials published a malicious version of a legitimate extension, live for about 25 hours((Cyberhaven, "Cyberhaven's Chrome extension security incident and what we're doing about it", 2024-12-27. The company's own post now redirects; quoted from the Internet Archive capture of 2024-12-27, fetched 2026-09-02: //"On December 24, a phishing attack compromised a Cyberhaven employee's credentials to the Google Chrome Web Store... The attacker used these credentials to publish a malicious version of our Chrome extension (version 24.10.4)."// and //"The malicious code was active between 1:32 AM UTC on December 25 and 2:50 AM UTC on December 26"//, which is where the 25 hours comes from. Wider figures circulating for that campaign — a count of affected extensions and of affected users — trace to security vendors rather than to Google or the affected companies, and are not used here.)). A single-snapshot corpus cannot see this. | * **The extension you download is not the extension the user runs.** Update deltas are where malice arrives {[pantelaios2020_changed]}, and the December 2024 Cyberhaven compromise is the worked example: a phishing attack on a developer's Web Store credentials published a malicious version of a legitimate extension, live for about 25 hours((Cyberhaven, "Cyberhaven's Chrome extension security incident and what we're doing about it", 2024-12-27. The company's own post now redirects; quoted from the Internet Archive capture of 2024-12-27, fetched 2026-09-02: //"On December 24, a phishing attack compromised a Cyberhaven employee's credentials to the Google Chrome Web Store... The attacker used these credentials to publish a malicious version of our Chrome extension (version 24.10.4)."// and //"The malicious code was active between 1:32 AM UTC on December 25 and 2:50 AM UTC on December 26"//, which is where the 25 hours comes from. Wider figures circulating for that campaign — a count of affected extensions and of affected users — trace to security vendors rather than to Google or the affected companies, and are not used here.)). A single-snapshot corpus cannot see this. |
| * **Extension IDs are stable, and they are derived, not assigned.** Chromium's ''id_util.cc'' computes them as the //"First 16 bytes of SHA256 hashed public key"//, hex-encoded and mapped from ''0''–''f'' onto ''a''–''p'' //"to avoid ever having a completely numeric host"//. So an ID persists across versions and across store removal, and it changes only if the developer rotates the signing key. Key on the ID, not on the name. | * **Extension IDs are stable, and they are derived, not assigned.** Chromium's ''id_util.cc'' computes them as the //"First 16 bytes of SHA256 hashed public key"//, hex-encoded and mapped from ''0''–''f'' onto ''a''–''p'' //"to avoid ever having a completely numeric host"//. So an ID persists across versions and across store removal, and it changes only if the developer rotates the signing key. Key on the ID, not on the name. |
