Loading story…
Google is removing Chrome extensions that still rely on Manifest V2 from the Chrome Web Store, accelerating its long-running migration to Manifest V3. Reports say 31 affected extensions are being delisted first, and from July 31 Manifest V2 add-ons will no longer be discoverable or installable from the store, even if some already-installed copies continue to run temporarily on older configurations. Google has tied the move to security and privacy changes that retire legacy extension capabilities and reduce broad access to browser activity.
The deprecation timeline shows Chrome has already phased out Manifest V2 support across multiple releases, with Chrome 138 described as the last version where such extensions could still function under limited conditions and Chrome 139 removing support entirely along with the enterprise ExtensionManifestV2Availability policy. Google also shifted extension networking controls away from the blocking webRequest API to declarativeNetRequest, which restricts behavior to predefined rules. While Chrome 150 introduced a temporary kExtensionManifestV2Disabled mechanism for re-enabling disabled extensions in some environments, Google plans further cleanup of legacy controls and says all remaining Manifest V2 extensions will be removed from the Chrome Web Store by August 31, 2026.
See the reporting duties and controls this puts on the clock.
11 events from the most recent confirmed update back to the earliest known activity.
By August 31, 2026, all remaining Manifest V2 extensions are removed from the Chrome Web Store, preventing reinstallation and updates for older Chrome installations that still have them installed.
Google announced that beginning July 31 it would remove Chrome Web Store extensions that still rely on Manifest V2, leaving already installed copies temporarily usable for some users but no longer discoverable or installable from the store.
Google said Chrome 151, scheduled for July 28, would remove legacy controls that allowed continued use of old Manifest V2 extensions, including the AllowLegacyMV2Extensions mechanism referenced for enterprise environments.
In Chrome 150, Google introduced the kExtensionManifestV2Disabled setting or flag to temporarily re-enable disabled Manifest V2 extensions.
By July 24, 2025, Google had universally disabled Manifest V2 extensions as part of the final stages of the deprecation.
Chrome 139 removes Manifest V2 support completely and also removes the enterprise ExtensionManifestV2Availability policy.
Chrome 138 was identified as the last Chrome release in which Manifest V2 extensions could still function under limited conditions.
A further phase of broader Manifest V2 disablement took place in March 2025 as Google advanced the deprecation timeline.
Google expanded Manifest V2 disablement in October 2024, continuing the staged removal of support across Chrome and the Chrome Web Store.
In June 2024, Google introduced warning banners for Manifest V2 extensions and removed featured badges as part of the deprecation process.
Google began the Manifest V2 phase-out in 2022 by restricting Chrome Web Store submissions for new public extensions using Manifest V2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
developers.chrome.com
Open sourcedeveloper.chrome.com
Open sourceopennet.me
Open sourceopennet.ru
Open sourcedeveloper.chrome.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has permanently purged Manifest V2 (MV2) extensions from the Chrome Web Store, ending official installation, reinstallation, and update access for legacy extensions. The move completes Chrome’s migration to Manifest V3 (MV3), which replaces persistent background pages and blocking `webRequest` interception with event-driven service workers and declarativeNetRequest filtering; MV3 also prohibits remotely hosted executable code. Google says the architecture improves extension security and performance. The removal affects extensions built on MV2, including the original **uBlock Origin**, which is no longer available through the Chrome Web Store; users are directed to the more restricted MV3-compatible **uBlock Origin Lite**. Organizations relying on temporary MV2 enterprise policy exemptions should plan migrations before those exemptions expire in forthcoming Chrome releases. Security teams should inventory managed-browser extensions, validate MV3 replacements, and assess compensating controls such as DNS-level filtering where MV3’s request-filtering limits affect required protections or customization.
Sep 1, 2026
Google is completing the removal of **Manifest V2** extensions in Chrome and other Chromium-based browsers, with enforcement beginning in **Chrome 150** and tightening further in **Chrome 151**. The change disables legacy extensions through controls such as `kExtensionManifestV2Disabled`, while temporary enterprise and developer overrides including `AllowLegacyMV2Extensions`, `kExtensionManifestV2Unsupported`, and `ExtensionManifestV2Availability` are being phased out. Google has tied the move to reducing technical debt and addressing security concerns in older extension-handling code. The deprecation directly affects **uBlock Origin**, whose classic version depends on the `webRequest` API that Manifest V3 replaces with the more restrictive `declarativeNetRequest` model. As a result, Chrome users are being pushed toward **uBlock Origin Lite**, which offers reduced functionality compared with the original extension. Reports indicate that Microsoft Edge and Opera are likely to follow Chromium’s upstream policy, while Firefox and Safari continue supporting the older extension model, and Brave and Vivaldi may remain alternatives for users who want stronger content-blocking capabilities.
Jun 29, 2026
Google has released **Chrome 151** to the stable channel, delivering a mix of user-facing, enterprise, and developer changes in the Chromium-based browser. The update adds new **Gemini** AI integrations, expands **Safe Browsing** protections, and improves PDF handling, while Google continues to distinguish Chrome from upstream Chromium through bundled components such as Google API integration, DRM support, and other Chrome-specific services. The release also keeps the **Extended Stable** channel available and indicates that **Chrome 152** is planned as the next major version. Chrome 151 also advances Google's transition away from legacy extensions by further restricting **Manifest V2** add-ons, though enterprises retain a temporary policy option to allow older MV2 extensions during migration. On the platform side, the browser drops support for **macOS 12** and now targets **macOS 13+**, while additional legacy browser features and APIs are being removed or deprecated, including older XML/XSLT-related functionality. The release further introduces web-platform updates for developers, including new HTML and `PerformanceObserver` capabilities, alongside broader changes affecting Windows, Linux, and macOS deployments.
Jul 30, 2026