Manifest V3 Killed uBlock Origin on Chromium — Here's the Technical Breakdown

In early August 2026, the uBlock Origin team shipped v1.73.0 and called it what it is: "quite likely the last stable uBO version to hit the web store." Google removes all remaining Manifest V2 (MV2) extensions from the Chrome Web Store on August 31. The people who wrote the best ad blocker ever written are treating this release as a funeral announcement.

This wasn't a sudden event. It was a five-year, carefully staged deprecation pushed almost entirely by Google — the company that maintains Chromium and derives the bulk of its revenue from the ad ecosystem uBlock Origin dismantles. Google claims this is about security. I don't buy it, and the technical details explain why.

Let's get into what Manifest V3 actually does to extensions, why it structurally breaks uBlock Origin, and why I'm now browsing with Zen Browser.

The Manifest System, in 30 Seconds

Every browser extension ships a manifest.json that declares what APIs it wants and how it runs. The manifest version is the platform contract between the extension and the browser. MV2, introduced in 2012, gave extensions:

• A persistent background page
• Full access to webRequest in blocking mode — the extension's JavaScript can observe, modify, or cancel every network request synchronously, before it hits the wire
• No hard cap on filtering logic — an extension can run whatever code it wants, whenever it wants

MV3, proposed by Google in 2019 and forced into existence over the following years, replaces this with:

• A non-persistent service worker that the browser can kill at any time
• webRequest demoted to observe-only mode (no blocking, no modifying)
• declarativeNetRequest (DNR) — a JSON rule engine inside the browser that extensions must declare in their manifest, with hard rule-count ceilings
• No arbitrary JavaScript allowed on the request path. Period.

Here's the same "block this script" in both worlds.

MV2 background script:

chrome.webRequest.onBeforeRequest.addListener(
  (details) => ({ cancel: true }),
  { urls: ["*://*.adservice.google.com/*"], types: ["script"] },
  ["blocking"],
);

MV3 declarative rule:

{
  "id": 1,
  "priority": 1,
  "action": { "type": "block" },
  "condition": {
    "urlFilter": "adservice.google.com",
    "resourceTypes": ["script"]
  }
}

The second one isn't just a different syntax. It's a fundamentally different architecture: the extension isn't blocking anything. It's declaring a rule, and the browser (or rather, a component written by the same people who make money on ads) decides whether and how to enforce it.

Why MV3 Structurally Breaks uBlock Origin

uBlock Origin (uBO) is not a big extension. It's a ~2MB package built by one person, Raymond Hill, who has been tuning it for over a decade. Its power comes from dynamic filtering: it evaluates tens of thousands of filter rules in real time, lets you block a single element with a click of the picker, and adjusts its own behavior per-site based on network requests you explicitly allow or deny.

MV3 takes away every one of those capabilities:

1. The rule caps are arbitrary and far too small

The declarativeNetRequest ceilings in Chromium are:

One subscription list like EasyList alone clears the static cap. uBO typically loads EasyList, EasyPrivacy, uBlock's own filters, and more — well over 100k rules. There is no way to fit that into 30,000 slots.

2. Blocking webRequest is gone — and nothing replaces it

The "blocking" permission in MV2 let uBO cancel a request and modify it (strip tracking parameters, rewrite headers). MV3 removes synchronous interception entirely. An MV3 extension cannot see a request in time to cancel it. It can only tell the browser "if this URL matches a declared rule, block it" and hope the browser's engine applies it.

3. Regex surgery

uBO uses regular expressions heavily for domain matches and complex cosmetic filtering. DNR caps regex rules at 1,000 and strips them down to a subset without lookaheads or backreferences. A good chunk of uBO's advanced filter syntax simply cannot be expressed.

4. Dynamic filtering is dead

The most powerful feature in uBO is the "dynamic filtering" pane — per-site, per-type toggles that update instantly. In MV3 that's dynamic rules, capped at 5,000 and applied via a JSON API the extension has to reload rules into. You cannot do real-time interactive blocking in MV3, and that's by design: Google's spec requires rule count limits to keep the declarative engine predictable.

The result is uBlock Origin Lite — gorhill's MV3 concession. It's a decent basic blocker, and it's nowhere near uBO. No dynamic filtering, no custom-scriptlet injection, capped cosmetic filters, capped rules. It's not a replacement. It's a severely neutered port that only exists because Google made the full thing impossible.

Google: Maintainer of Chromium, Author of the Apocalypse

Here's the part that matters. Google is not one of several stakeholders in the web platform — it's the platform. Chromium is the base of Chrome, Edge, Brave, Opera, Vivaldi, Arc, and everything else with a Chrome-derived engine. That's roughly 90% of desktop browser usage. When Google deletes a code path from the Chromium source tree, every one of those projects inherits the deletion unless they maintain their own patches.

That's exactly what happened. Chromium 150 (June 30, 2026) deleted the kExtensionManifestV2Disabled flag. Chromium 151 (July 28, 2026) removed every remaining MV2 code path, including the ExtensionManifestV2Availability machinery. A Google engineer framed the cleanup on the Chromium commit:

MV2 extensions are no longer allowed in any supported version of Chrome, and we are removing support for them and the associated functionality. We won't be able to provide / maintain this functionality indefinitely due to the complexity and tech debt, as well as the security risks it entails.

Google's stated rationale for MV3 has always been "security, stability, and performance." Here's the full MV2-to-MV3 timeline, so you can see how "security" was operationalized:

Why the security argument doesn't hold water

I'm not a security researcher, but I can read a spec, and the security claim is hard to square with the actual design:

1. The caps aren't security controls. A hard ceiling of 30,000 static rules doesn't make the browser safer — it makes it safer for ad networks. Malicious extensions don't need 30,001 rules. The limit exists to cap filtering power, not attack surface.

2. MV3 extensions can still read everything. The most dangerous permission in extensions — host access (<all_urls>) that lets an extension exfiltrate every page you visit — is unchanged in MV3. If privacy were the goal, that's the thing to restrict. It wasn't touched.

3. The performance argument cuts the other way. Blocking webRequest is slow because it serializes network through the extension process. But Chrome already had a solution: Chrome's own built-in ad blocker (announced 2018, removed 2020) ran inside the browser at full speed. DNR is literally that internal engine, exposed as an extension API. The fast path always existed — Google just decided extensions can't have it.

4. The incentive structure. Google doesn't make money selling browsers. Alphabet makes ~80% of its revenue from advertising. The company that prices and places ads is also the company that owns the code determining whether ad-blocking extensions can function. Claiming conflict of interest doesn't make a technical argument — but ignoring it makes you naive. MV3's practical effect was always clear: degrade the tools that attack Google's core business, wrapped in a security narrative.

The Chromium Cascade: Who Caved, Who Fought

Because Chromium is the base of nearly everything, the MV2 removal rippled outward. Each of these browsers is built on Chromium — which means each one must maintain its own patch to keep MV2 alive, and only one does it properly:

Brave is the exception that proves the rule. It hardcoded MV2 support for those four extensions into the browser itself, which shows two things: keeping MV2 alive is technically trivial (a few flags and code paths Google deliberately deleted), and virtually no one else could be bothered to do it. Opera and Vivaldi are on borrowed time — Chromium 151 removed the source, so their support is only as long as they're willing to maintain diverging patches.

Microsoft's Edge is the second-biggest Chromium horse, and its fate is now sealed too.

Edge: The Last Chromium Holdout Gets a Date

For years, Microsoft played both sides of the MV2 question. It committed Edge Add-ons to MV3 back in October 2020, stopped accepting new MV2 extensions — already in July 2022 — and then sat on the actual removal indefinitely, insisting the Edge team would "independently decide" and that enterprises could lean on the ExtensionManifestV2Availability policy. Users kept uBlock Origin on Edge that whole time, and Microsoft was content to never commit to a cutoff date.

That ended on August 7, 2026. Microsoft published Moving the Microsoft Edge extensions ecosystem forward with Manifest Version 3, the firmest timeline Edge has ever had:

The numbers Microsoft cited are telling. Only 58 MV2 extensions remain in the Edge Add-ons store with any meaningful usage, and just 3 of those lack an MV3 equivalent or migration roadmap. 95% of the top MV2 extensions had already jumped to MV3 — because for most extension categories, MV3 is fine. But Microsoft doesn't hide what the 58 are: "This will end support for uBlock Origin on Edge, alongside a small group of other extensions."

Edge is a good example of why MV3 always wins by attrition. Microsoft isn't Google, doesn't run an ad business, and had every incentive to keep developers happy — but its browser is Chromium, and maintaining a divergent MV2 patch against a hostile upstream is a cost no derivative browser wants to pay forever. When the entity upstream deletes the code, every downstream consumer eventually follows. Edge bought itself four extra years and spent exactly none of them building an alternative.

Gecko: The Only Real Escape

Firefox doesn't run Chromium. It runs Gecko, Mozilla's own engine, and Mozilla never had an ad business to protect. Mozilla has explicitly committed to supporting both MV2 and MV3 in parallel, and — crucially — it kept the blocking webRequest API that Chrome removed. That means:

• Full, unmodified uBlock Origin runs on Firefox, maintained by gorhill with the same feature set as always
• Dynamic filtering, custom lists, the element picker — all of it works exactly as it did in 2021
• MV2 extensions on Firefox are unaffected by anything Google does to Chromium

The whole MV3 saga proves a larger point: the browser is the platform, and the browser is the product. When the entity that owns the browser has a financial interest in what your extensions can do, your extensions are hostage to that interest. Gecko is the only mainstream engine whose steward doesn't have skin in the ad game. Firefox ships tracking protection and Total Cookie Protection by default, because Mozilla's incentives are aligned with the user, not the advertiser.

Why I Switched to Zen Browser

So: Firefox is the engine that keeps my tools alive. But for years I kept coming back to Chromium because the browser itself felt better — vertical tabs, workspaces, a clean UI. Firefox's UI felt stuck in 2014, and I hated horizontal tabs wasting my ultrawide's horizontal space.

Enter Zen Browser. It's an open-source Firefox fork (Gecko, not Chromium) that takes Firefox and makes it gorgeous — and it's become my daily driver. Here's what that looks like:

Full uBlock Origin, running exactly like it should:

Zen's whole experience is built around vertical tabs, which means the tab bar is a sidebar instead of a horizontal strip eating 100 pixels of my 21:9 monitor. Combined with Compact Mode — the sidebar auto-hides when you don't hover it — the browser gives back more screen real estate than any Chromium UI I've tried:

The features that sold me:

• Workspaces — persistent, per-project tab groups with their own containers and pinned tabs. It's like having a separate browser per task without the process overhead
• Split View — view two tabs side by side in one window, drag a tab onto another to split them, and un-split just as easily
• Glance — hover a link to preview the page without leaving your current tab
• Zen Mods — a first-party mod ecosystem (think extensions for the UI itself): floating URL bars, tab tooltips, layout tweaks, all installed from the browser's own mod store
• Privacy by inheritance — it's Firefox under the hood, so you get tracking protection, Total Cookie Protection, and every about:config knob, plus Zen's own flags
• Fully open source (zen-browser/desktop on GitHub) and built on the current Firefox release (152.0.2)

Split view in action:

And Glance, the link-preview feature:

The cherry on top: because it's Gecko, uBlock Origin just works. Full version, all features, same-day filter updates. I installed it, imported my Firefox profile, and never looked back. If you're on Chrome, your extension is already dead — on Edge, it dies by the end of 2026. Either way, you can switch now.

The Takeaway

Manifest V3 was never really about security. It was a lever that Google — the maintainer of Chromium and the largest ad company on earth — used to cap what extensions can do, while claiming the cap was for our own good. Every Chromium browser inherited that decision because they all stand on Google's engine.

The fix is structural: use a browser whose engine isn't owned by someone who sells what you're blocking. Firefox kept MV2 alive by choice. Zen Browser makes that choice worth making — it's the first Firefox-based browser I've used that feels better than Chrome, not just safer.

Try it: zen-browser.app. Your ad blocker will thank you.