Reply to thread

Message

<blockquote data-quote="oldschool" data-source="post: 1117927" data-attributes="member: 71262">[USER=57714]@Vitali Ortzi[/USER] If only &#039;vetted&#039; extensions are secure, than where&#039;s the MV3 advantage over a vetted MV2?<a href="https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security" target="_blank">Google’s Plans for Chrome Extensions Won’t Really Help Security</a>For instance, part of the supposed advantage is a prohibition on remotely hosted code. Except there is this flaw in their change, from <a href="https://palant.info/2025/01/20/malicious-extensions-circumvent-googles-remote-code-ban/" target="_blank">Malicious extensions circumvent Google’s remote code ban</a>There are other examples, such as abuse of declarativeNetRequest API, Content Security Policy, etc.<a href="https://www.techradar.com/pro/google-chrome-extensions-remain-a-security-risk-as-manifest-v3-fails-to-prevent-data-theft-and-malware-exploitation" target="_blank">Google Chrome extensions remain a security risk as Manifest V3 fails to prevent data theft and malware exploitation</a>And other considerations like here <a href="https://leastauthority.com/blog/manifest-v2-to-v3-challenges-and-security-considerations/" target="_blank">Manifest V2 to V3: Challenges and Security Considerations. - Least Authority</a>You still haven&#039;t explained how MV3 is inherently more secure than MV2.</blockquote>

[QUOTE="oldschool, post: 1117927, member: 71262"] [USER=57714]@Vitali Ortzi[/USER] If only 'vetted' extensions are secure, than where's the MV3 advantage over a vetted MV2? [URL='https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security']Google’s Plans for Chrome Extensions Won’t Really Help Security[/URL] For instance, part of the supposed advantage is a prohibition on remotely hosted code. Except there is this flaw in their change, from [URL='https://palant.info/2025/01/20/malicious-extensions-circumvent-googles-remote-code-ban/']Malicious extensions circumvent Google’s remote code ban[/URL] There are other examples, such as abuse of declarativeNetRequest API, Content Security Policy, etc. [URL='https://www.techradar.com/pro/google-chrome-extensions-remain-a-security-risk-as-manifest-v3-fails-to-prevent-data-theft-and-malware-exploitation']Google Chrome extensions remain a security risk as Manifest V3 fails to prevent data theft and malware exploitation[/URL] And other considerations like here [URL='https://leastauthority.com/blog/manifest-v2-to-v3-challenges-and-security-considerations/']Manifest V2 to V3: Challenges and Security Considerations. - Least Authority[/URL] You still haven't explained how MV3 is inherently more secure than MV2. [/QUOTE]

Verification