Now Mozilla will let extensions use the most privacy-preserving blocking techniques on network traffic.

There is a growing division over how much room browsers should leave for ad blocking — and Firefox and Chrome have ended up on opposite sides of the fight. The rupture centers on a feature called Web Request. It is mainly used in ad blockers and essential for any system that looks to block off a domain wholesale.

Google has long had security concerns about Web Request and has worked to cut it out of the most recent extension standard, called Manifest V3, or MV3 for short. But, now Mozilla made clear that Firefox will maintain support for Web Request, keeping the door open for the most sophisticated forms of ad blocking.

Privacy advocates have roundly criticized Google’s strategy — the Electronic Frontier Foundation has been a vocal opposition — but the search company hasn’t been convinced. So, Firefox has a far smaller share of the desktop marketplace than Chrome; it could be a possibility for Mozilla’s product to define itself. For Google, though, sticking with MV3 will hugely affect the overall role of ad blocking on the current web.

Manifest V3

The modifications in Manifest V3 are part of a planned overhaul to the specification for Chrome’s browser extension manifest file. It represents the approvals, capabilities, and system resources that any extension can use.

Under the currently active specification — Manifest V2 — browser extensions can use an API feature called Web Request to observe traffic between the browser and a website and modify or block requests to specific domains.

The example Google offers for developers shows an extension script that would block the browser from sending traffic to “evil.com”

The Web Request feature is powerful and flexible and can be used for good and bad intentions. For example, ad-blocking extensions use the feature to block incoming and outgoing traffic between specific domains and a user’s browser.

They block domains that will load ads and stop information from being sent from the browser to any of the thousands of tracking domains that collect data on internet users. But the same feature can be used cruelly to hijack users’ login credentials or insert extra ads into web pages, which has been Google’s settings for changing how it functions in Manifest V3.

The blocking version of the Web Request API has been removed and replaced with an API called Declarative Net Request under the latest specification. Instead of monitoring all data in a network request, the new API forces extension makers to specify rules in advance about how certain types of traffic should be handled, with the extension able to perform a more narrow set of actions when a rule is triggered.

It won’t be a problem for some extensions: Adblock Plus, one of the most famous ad blockers, has come out in favor of the MV3 changes — though it’s worth noting that the extension has a financial relationship with Google. Others, however, may be more severely affected.

Google has introduced the modifications as a benefit to privacy, security, and performance. Still, critics see it as a calculated effort to limit the impact of ad blocking on a company that is almost completely funded by ads. (In its SEC filings, Google consistently cites “new and existing technologies that block ads online” as a risk factor that could affect revenue.)

But the makers of some ad blocking and privacy-protecting extensions have said the change will disable the effectiveness of their products. Jean-Paul Schmetz, CEO of the privacy-focused browser extension Ghostery, took precise aim at Google’s imposition of the MV3 standard in light of the company’s recent statements on defending privacy:

“While Google is pushing a ‘privacy by design’ message on the surface, it’s still asserting a monopoly over the entire ecosystem by stifling digital privacy companies that are already working to give users back control of their data,” Schmetz told The Verge by email.

The Ghostery extension is an excellent example of a product that would be especially affected by Google’s changes. Besides blocking ad content, the extension examines communications between a website and a user’s browser to look for data that could unintentionally recognize a unique site visitor and replaces it with generic data before the network traffic leaves the browser. However, doing this needs the capability to change web traffic on the fly and, as such, will be severely trimmed by the MV3 restrictions, the developers say.

Ad blocker developers are also concerned because the effects of those changes will run far beyond the Chrome browser. The MV3 spec is part of the Chromium project, an open-source web browser developed by Google that forms the basis of not only Chrome but also Microsoft Edge, the privacy-focused Brave, the lightweight browser Opera, and many others. Since Chromium underpins these projects, browsers that depend on it will ultimately have to migrate to the MV3 extension format, and extensions for those browsers will no longer be capable of ad-blocking using Web Request.

Mozilla Pushes Back

Google exerts tremendous power over what browser extensions can and can’t do as the primary developer of Chromium. Moreover, it sets apart browsers not based on Chromium — notably Firefox and Safari — because they can take a different approach to extension methods and are now in a position to differentiate themselves with a more permissive procedure to ad blocking.

For compatibility logic, Mozilla will still use most of the Manifest V3 spec in Firefox, so extensions can be ported over from Chrome with minimal modifications. But, crucially, Firefox will resume supporting blocking through Web Request after Google phases it out, allowing the most refined anti-tracking ad blockers to function as expected.

In explaining that decision, Mozilla has acknowledged that privacy is a core value for people who use its products, as chief security officer Marshall Erwin told The Verge.

“We know content blocking is important to Firefox users and want to ensure they have access to the best privacy tools available,” Erwin said. “In Firefox, we block tracking by default but still allow advertisements to load in the browser. If users want to take the additional step to block ads entirely, we think it is important to enable them to do so.”

As for Google’s assertions about the safety benefits of its MV3 changes, Erwin said that quick security gains from preventing Web Request blocking were “not obvious” — especially since had been kept other non-blocking features of Web Request — and didn’t seem to make substantial reductions in the possibility of data leakage.

Google has listened to positive feedback about the changes from many content blocking extension developers, Westover said, pointing The Verge to praise from the makers of Adblock Plus.

Firefox’s stance on ad blocking may encourage more users to switch to the browser, which is now estimated to make up less than 8 percent of the desktop browser market compared to Chrome’s 67 percent.