Google Manifest V3 and Malwarebytes Browser Guard

We wanted to update you on some changes that Google’s making, and what we’re doing in Browser Guard to keep you protected. 

Some of our customers have recently reported seeing messages that say Browser Guard may soon no longer be supported in their browser. Luckily, there’s no need for you to worry: You’ll continue to get the same Browser Guard protection and experience, we’ve just had to make some adjustments in how we build the extension. 

Today, we brought out the new version of Browser Guard which addresses Google’s changes. If you want to read more of the technical details then you can do so below, or you can head straight over to the Chrome or Edge stores now to update. 

A similar change in Firefox is coming soon and we’ll let you know when it’s ready. 

What is Google changing? 

For those not familiar with the terms, Google’s Manifest V2 and V3 are the “rules” that browser extension developers are required to follow if they want their extensions to get accepted into the Chrome Web Extension Store.  

Google says Manifest V3 was brought in to improve the security, privacy, performance, and trustworthiness of the extension ecosystem, while still protecting existing functionality. 

The phasing out of Manifest V2 began at the end of May, and the Chrome Web Store no longer accepts Manifest V2 extensions, although browsers can still use them for the time being. 

How does Manifest V3 affect Browser Guard? 

One of the new changes that impacts Browser Guard and many other ad (and malicious content) blockers is that extensions will be limited in the number of rules they can include. That’s a problem because ad blockers historically rely on a large number of rules. 

Cybercriminals have the habit of setting up new domains by the dozen, and, generally speaking, each blocked domain or subdomain requires one rule. So if ad blockers want to keep up, they too have to continuously create new rules. 

Google has made some compromises after objections were raised when the company first announced Manifest V3, but there are still limitations which have an effect. 

How Malwarebytes has dealt with this 

The new limitations of Manifest V3 meant we had to develop a different way to block content for our users that use Chromium based browsers like Google Chrome and Microsoft Edge.  

The new Browser Guard uses a mix of static and dynamic rules to protect our users. 

Static rules are rules that are contained in the ruleset files which can be seen as block lists. These files are shipped with each version release. 

Dynamic rules are rules that can be added and removed at runtime. Chrome allows up to 30,000 dynamic rules. Browser Guard uses dynamic rules for two purposes: 

Session rules are dynamic rules that can be added and removed at runtime, but they are session-scoped and are cleared when the browser shuts down and when a new version of the browser is installed.  Dynamic rules can be used to store allow lists, user blocked content, and general rules that block more than one domain. Take, for example, the IP address of a server that is known to host nothing but phishing sites. 

To deal with urgent situations we can use ruleset overrides, which are a mechanism by which we can override the static rules shipped with Browser Guard without requiring our users to add exclusions. 

Your version of Browser Guard will be automatically updated to the latest version, but if you want to get it now you can do so for Chrome or Edge. 

A note on updating Browser Guard

When updating to the latest version of Browser Guard, your browser may prompt you with new or additional permissions. Each browser describes these permissions differently and all can be confusing. 

This language can sound confusing, so let’s clarify what those terms mean with respect to Browser Guard in particular. 

Chrome: 

“Read and change all your data on all websites”: This refers to us monitoring for scams, phishing, ads, and malicious URLs. We also monitor content on pages to check for ads, trackers, phishing, scams, and malware.  “Modify data you copy and paste”: This allows you to share the download URL for Browser Guard with friends and family, so they can stay safe too. We are not reading the contents of your clipboard.  “Manage your downloads”: When you download something, we check that it isn’t malicious before you install it and potentially infect your computer.  “Communicate with cooperating native applications”: This allows Browser Guard to integrate with our Windows app to ensure you have a more comprehensive protection suite enabled. 

Edge: 

“Read and change all your data on all websites” or “Read your browsing history”: This refers to us monitoring for scams, phishing, ads, and malicious URLs. We also monitor content on pages to check for ads, trackers, phishing, scams, and malware.  “Modify data you copy and paste”: This allows you to share the download URL for Browser Guard with friends and family, so they can stay safe too. We are not reading the contents of your clipboard.  “Manage your downloads”: When you download something, we check that it isn’t malicious before you install it and potentially infect your computer.  “Communicate with cooperating native applications”: This allows Browser Guard to integrate with our Windows app to ensure you have a more comprehensive protection suite enabled.  “Block content on any page”: This refers to us identifying scams, phishing, ads, trackers and malware and then protecting your device from them. 

For more information on how we use your information, please see the Browser Guard Privacy Policy. 

Thanks for continuing to choose Malwarebytes to protect you.