Loading story…
Google has permanently purged Manifest V2 (MV2) extensions from the Chrome Web Store, ending official installation, reinstallation, and update access for legacy extensions. The move completes Chrome’s migration to Manifest V3 (MV3), which replaces persistent background pages and blocking webRequest interception with event-driven service workers and declarativeNetRequest filtering; MV3 also prohibits remotely hosted executable code. Google says the architecture improves extension security and performance.
The removal affects extensions built on MV2, including the original uBlock Origin, which is no longer available through the Chrome Web Store; users are directed to the more restricted MV3-compatible uBlock Origin Lite. Organizations relying on temporary MV2 enterprise policy exemptions should plan migrations before those exemptions expire in forthcoming Chrome releases. Security teams should inventory managed-browser extensions, validate MV3 replacements, and assess compensating controls such as DNS-level filtering where MV3’s request-filtering limits affect required protections or customization.
Trace attribution and downstream blast radius.
1 event from the most recent confirmed update back to the earliest known activity.
Google permanently removed all remaining Manifest V2 extension listings from the Chrome Web Store, completing the final MV2 deprecation phase. MV2 extensions can no longer be installed, reinstalled, or updated through the official store; uninstalled extensions cannot be recovered from Google's repositories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google is removing Chrome extensions that still rely on **Manifest V2** from the Chrome Web Store, accelerating its long-running migration to **Manifest V3**. Reports say 31 affected extensions are being delisted first, and from July 31 Manifest V2 add-ons will no longer be discoverable or installable from the store, even if some already-installed copies continue to run temporarily on older configurations. Google has tied the move to security and privacy changes that retire legacy extension capabilities and reduce broad access to browser activity. The deprecation timeline shows Chrome has already phased out Manifest V2 support across multiple releases, with Chrome 138 described as the last version where such extensions could still function under limited conditions and Chrome 139 removing support entirely along with the enterprise `ExtensionManifestV2Availability` policy. Google also shifted extension networking controls away from the blocking `webRequest` API to `declarativeNetRequest`, which restricts behavior to predefined rules. While Chrome 150 introduced a temporary `kExtensionManifestV2Disabled` mechanism for re-enabling disabled extensions in some environments, Google plans further cleanup of legacy controls and says all remaining Manifest V2 extensions will be removed from the Chrome Web Store by August 31, 2026.
Jul 12, 2026
Google is completing the removal of **Manifest V2** extensions in Chrome and other Chromium-based browsers, with enforcement beginning in **Chrome 150** and tightening further in **Chrome 151**. The change disables legacy extensions through controls such as `kExtensionManifestV2Disabled`, while temporary enterprise and developer overrides including `AllowLegacyMV2Extensions`, `kExtensionManifestV2Unsupported`, and `ExtensionManifestV2Availability` are being phased out. Google has tied the move to reducing technical debt and addressing security concerns in older extension-handling code. The deprecation directly affects **uBlock Origin**, whose classic version depends on the `webRequest` API that Manifest V3 replaces with the more restrictive `declarativeNetRequest` model. As a result, Chrome users are being pushed toward **uBlock Origin Lite**, which offers reduced functionality compared with the original extension. Reports indicate that Microsoft Edge and Opera are likely to follow Chromium’s upstream policy, while Firefox and Safari continue supporting the older extension model, and Brave and Vivaldi may remain alternatives for users who want stronger content-blocking capabilities.
Jun 29, 2026
Google and Microsoft removed the **ModHeader** browser extension from the Chrome Web Store and Edge Add-ons store after researchers found dormant code in the official signed extension that could collect users’ browsing domains and prepare them for exfiltration. Analyses of versions `7.0.17` and `7.0.18` found a built-in pipeline that extracted domains from visited URLs, encrypted them with **AES-GCM**, stored up to 1,000 entries locally in IndexedDB or browser storage, and staged them for upload to `api.stanfordstudies[.]com/app/log`. Researchers said the internal allow-list controlling the collector was empty, and they reported no evidence that browsing-domain data was actually transmitted. The extension had an estimated **1.6 million users** across Chrome and Edge and already held broad permissions, raising concern that the dormant capability could have been activated later through a routine signed update without prompting users for new access. Separate reporting said the extension also sent active telemetry for install, update, and uninstall events to `extensions-hub[.]com`, while a script running on every page logged request metadata locally in plaintext. Microsoft reportedly removed the Edge listing first, and Google later flagged the Chrome version as malware and pulled it, underscoring the supply-chain risk posed by trusted, high-permission browser extensions.
Jul 15, 2026