Google today reached the final milestone in a browser-extension transition that has been years in the making, all remaining Manifest V2 extensions were removed from the Chrome Web Store.
    • John Richard@lemmy.worldEnglish
      1·
      1 month ago

      Not really. UBlock Origin Lite works really well. They even added content scripts recently. From a technical perspective MV3 offers more security by default.

      • Kangae_Hishiryo@scribe.disroot.orgEnglish
        0·
        1 month ago

        No, they’re intrinsically less secure.

        They generate memory issues (use-after-free, dangling pointers, double free(), zombie processes, uncomplete teardown, GC failures or abrupt stops, race conditions, etc.) because of their shitty isolation, and their poor service-workers and IPC architecture.

        What’s worse, they greatly limit the network APIs needed to active defense (DNR instead of webRequest).

        • John Richard@lemmy.worldEnglish
          1·
          1 month ago

          No, they’re intrinsically less secure.

          GrapheneOS disagrees with you:

          https://grapheneos.org/usage#web-browsing

          I agree however that Chromium has some issues still. I have personally managed to crash my browser when calling the Mojo APIs via JavaScript. However, it wasn’t related to security. As GrapheneOS notes, no other browser engine provides the same levels of sandboxing. Recognizing the effectiveness of Chrome’s sandbox, Microsoft began evolving Windows kernel access control to formalize and harden these techniques at the OS level. The upcoming Windows Updates implements this in its new ProcessContainer support.

          Blaming process isolation and IPC for memory bugs like Use-After-Free and dangling pointers fundamentally confuses language-level C++ problems with OS containment architecture. Memory corruption exists across all C++ engines (Gecko, WebKit, Blink); isolation is what prevents those bugs from compromising the host OS.

          Handing third-party extensions blanket permissions to inspect and modify live plaintext traffic across all tabs creates a massive MITM exfiltration surface. Moving rule matching to declarativeNetRequest enforces least privilege by executing filters in the native engine without exposing sensitive network payloads to extension code.

          webRequestBlocking is not deleted in MV3. The synchronous blocking engine still exists in Chromium. If an extension is installed via local policy or the Windows Registry (ExtensionInstallForcelist), full programmatic webRequestBlocking executes in Manifest V3 just as it did in MV2.

  • danielfm123@lemmy.zipEnglish
    01·
    1 month ago

    Install Firefox with https://adnauseam.io/, it’s basically ublock origin but internally clicks on every add destroying your adds profile and damaging economics of adds and conversion.