Mozilla says Firefox won't defang ad blockers – unlike a certain ad-giant browser

On Tuesday, Mozilla said it is not planning to change the ad-and-content blocking capabilities of Firefox to match what Google is doing in Chrome.

Google's plan to revise its browser extension APIs, known as Manifest v3, follows from the web giant's recognition that many of its products and services can be abused by unscrupulous developers. The search king refers to its product security and privacy audit as Project Strobe, "a root-and-branch review of third-party developer access to your Google account and Android device data."

In a Chrome extension, the manifest file (manifest.json) tells the browser which files and capabilities (APIs) will be used. Manifest v3, proposed last year and still being hammered out, will alter and limit the capabilities available to extensions.

Developers who created extensions under Manifest v2 may have to revise their code to keep it working with future versions of Chrome. That may not be practical or possible in all cases, though. The developer of uBlock Origin, Raymond Hill, has said his web-ad-and-content-blocking extension will break under Manifest v3. It's not yet clear whether uBlock Origin can or will be adapted to the revised API.

The most significant change under Manifest v3 is the deprecation of the blocking webRequest API (except for enterprise users), which lets extensions intercept incoming and outgoing browser data, so that the traffic can be modified, redirected or blocked.

Firefox not following

"In its place, Google has proposed an API called declarativeNetRequest," explains Caitlin Neiman, community manager for Mozilla Add-ons (extensions), in a blog post.

"This API impacts the capabilities of content blocking extensions by limiting the number of rules, as well as available filters and actions. These limitations negatively impact content blockers because modern content blockers are very sophisticated and employ layers of algorithms to not only detect and block ads, but to hide from the ad networks themselves."

Mozilla offers Firefox developers the Web Extensions API, which is mostly compatible with the Chrome extensions platform and is supported by Chromium-based browsers Brave, Opera and Vivaldi. Those other three browser makers have said they intend to work around Google's changes to the blocking webRequest API. Now, Mozilla says as much.

"We have no immediate plans to remove blocking webRequest and are working with add-on developers to gain a better understanding of how they use the APIs in question to help determine how to best support them," said Neiman.

Mozilla, however, is more receptive to other planned changes from Google. Manifest v3's changes to require content scripts to have the same permissions as the pages where they get injected will be adopted. And revisions of background service workers, more granular runtime host permissions and broader limitations on remotely hosted code remain under consideration.

Google has said Manifest v3 is "motivated by a desire to keep users safe and to give them more visibility and control over the data they’re sharing with extensions."

There's clearly a need for better browser extension security and not just in the Chrome ecosystem. Last week, for example, Mozilla removed an extension called Ad-Blocker because it was executing remote code in violation of rules.

The question is whether content and ad blocking must get worse for security to get better. Google maintains, "We are not preventing the development of ad blockers or stopping users from blocking ads," even as it acknowledges "these changes will require developers to update the way in which their extensions operate."

Yet Google's related web technology proposal two weeks ago to build a "privacy sandbox," through a series of new technical specifications that would hinder anti-tracking mechanisms, has been dismissed as disingenuous "privacy gaslighting."

On Friday, EFF staff technologist Bennett Cyphers, lambasted the ad biz for its self-serving specs. "Google not only doubled down on its commitment to targeted advertising, but also made the laughable claim that blocking third-party cookies – by far the most common tracking technology on the Web, and Google’s tracking method of choice – will hurt user privacy," he wrote in a blog post.

So when Google, the world's largest online ad company, says it's fine with ad blocking – even though its financial filings have cited ad blocking as a revenue risk – there's some reason to be skeptical.

Google's Chrome team is still working on a Developer Preview of Manifest v3. ®