Google makes the perfect case for why you shouldn’t use Chrome

Back in 2020, Google released Manifest V3, which it called a step in the direction of security, privacy and performance. 

It took a while, but on Dec. 9, 2021, the Electronic Frontier Foundation labeled MV3 a “conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.“

The EFF is right, and Google’s plans for MV3 is yet another reason why the best browser for Linux, Windows and Mac isn’t Google Chrome.

Let me explain.

What is Google Manifest V3 (MV3)?

Manifest V3 for Chrome Extensions (MV3) is a set of guidelines for how Google’s web browser handles extensions. Developers could begin uploading extensions to the Chrome Web Store starting with Chrome 8, which was released in January 2021. According to Google, MV3 is designed to help the company provide “improvements to security, performance and privacy—while preserving or extending the capability of extensions and keeping a webby developer experience.”

SEE: It’s time to dump Chrome as your default browser on Android (TechRepublic)

Now, on the surface, MV3 could be seen as a means to a very protective end. Why? Because there are browser extension developers who are creating malicious tools to thwart the security of browsers. To that end, MV3 will go a very long way to restrict the capabilities of web browser extensions. This is good. Very good. It’s also long overdue. Almost daily, we hear of yet another threat to web browser safety, and many times that lack of security is found to be a problem with an extension.

So, for Google to create guidance that would prevent bad actors from doing what they do is a major win for those who take web browser security seriously. However, there’s another side to this coin. 

Google Manifest V3 creates issues for users and devs

There are a lot of developers who create extensions on which millions upon millions of users depend. Among that massive group of users are those who install ad blockers and other extensions to prevent websites from collecting and using their data. Case in point: According to the 2021 PageFair Adblock Report from ad firm Blockthrough, the number of people using ad-blocking software on mobile browsers is 586 million and on desktop browsers is 257 million. These are not small numbers. And those numbers are only going to continue to rise as more and more sites deploy a larger percentage of ads. The question then becomes, are the current numbers low enough such that Google can brush them off? Because when MV3 is put into place, Chrome users who prefer to use a browser with ad-blocking extensions in place could be out of luck.

To complicate this issue, if potentially breaking ad-blockers wasn’t enough, MV3 could also negatively affect user privacy by preventing extensions that block third-party tracking from functioning. Chrome does offer Incognito Mode, which is designed to prevent sites from tracking user activity, so Google understands that privacy is important to users. But anyone that’s used Incognito Mode knows it’s not enough. Although it does help with the prevention of tracking, it doesn’t block ads. And although I don’t have a problem with businesses promoting themselves with ads because companies do have to keep the lights on, not every ad is created equal and some have been found to be quite malicious. I know users who install ad-blocking extensions as a means to (hopefully) prevent malicious ads from infecting their desktops. It’s a shame then that MV3 could take away another tool users have to protect their privacy and the integrity of the devices they use.

From my perspective, Google is making a perfect case for why users should migrate away from Chrome. 

It’s not just about users

MV3 doesn’t just create issues for end-users. Developers could face challenges as well. According to the EFF: “The changes in Manifest V3 won’t stop malicious extensions but will hurt innovation, reduce extension capabilities and harm real-world performance. Google is right to ban remotely hosted code (with some exceptions for things like user scripts), but this is a policy change that didn’t need to be bundled with the rest of Manifest V3.”

SEE: Feature comparison: Time tracking software and systems (TechRepublic Premium)

The EFF is spot on. Yes, Google should (with few exceptions) ban remote code. But releasing guidance that breaks so much functionality for third-party extensions isn’t the way to go. And for developers, this could lead to many of them having to work with two different code bases—one for Chrome and one for all other browsers. That’s a proposition many devs won’t accept.

Is it in Google’s best interest to prevent the development and usage of ad-blocking extensions? Probably not. But by creating guidance that prevents those developers from creating non-malicious (often helpful) addons, they are putting themselves in a rather awkward position. End users should be able to leverage as much privacy as they want with a browser. And the fact that Chrome comes with an Incognito Mode (that prevents tracking), makes it clear Google understands how important privacy is.

If Google’s MV3 prevents the creation of ad blockers for Chrome, what are those users to do?

MV3 is another reason to stop using Chrome

In an ideal world, there would be a widely agreed-upon and enforceable set of rules for user privacy and security that browser makers would follow, similar to how many countries have laws that govern safety standards for automobiles. Unfortunately, that isn’t the case.

Google and other browser makers have way too much time, capital and resources invested into their creations to allow a third party to take control. On top of that, Google would have to collaborate with Apple, Microsoft, Mozilla, Opera, Brave, Vivaldi and any other browser maker that has a vested interest in this issue. Again … not gonna happen.

The other issue with using a third party is that no one with the proper authority to govern such a body exists. And we all know how slow governments are to implement such a change. This is technology, where change happens in the blink of an eye. If a government did get involved, by the time it voted something like this into existence, the need for it would have probably already been mitigated.

I’m not holding my breath for a third party to take control of this situation, and neither should you.

So, what can you do? The solution is simple. Change browsers. Migrate to a browser that doesn’t prevent you from using ad blockers or other extensions, which prevent the collection of your data. Switch to a browser that’s not based on Chrome, such as Firefox (for Linux, macOS or Windows) or Safari (for macOS). Use any browser based on Chrome and you run the risk of losing the ability to install those extensions.

It’s your web browser, your experience, your security and your data. You should have the final say in what can and cannot be added to bolster the privacy of the application and the data it uses.

Jonathan Mayer, assistant professor of computer science and public affairs at Princeton University, said it best in a quote to the EFF:

“A web browser is supposed to act on behalf of the user and respect the user’s interests. Unfortunately, Chrome now has a track record as a Google agent, not a user agent. It is the only major web browser that lacks meaningful privacy protections by default, shoves users toward linking activity with a Google Account and implements invasive new advertising capabilities. Google’s latest changes will break Chrome privacy extensions, despite academic research demonstrating that no change is necessary. These user-hostile decisions are all directly attributable to Google’s surveillance business model and enabled by its dominance of the desktop browser market.”

Cybersecurity Insider Newsletter

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.
Delivered Tuesdays and Thursdays

Sign up today

Also see