What changed technically
V3 uses service workers that can be suspended, making state persistence explicit. Host permissions move to host_permissions. The default CSP disallows eval, and executable code must generally be bundled rather than fetched at runtime.
Network interception shifts toward declarativeNetRequest rules instead of blocking webRequest in many cases. This changes capability and privacy in ways that depend on the extension's implementation.
| Area | Manifest V2 | Manifest V3 |
|---|---|---|
| Background | Persistent page possible | Event-driven service worker |
| Host permissions | Commonly in permissions | Separate host_permissions |
| Remote code | Looser historical rules | Executable code generally bundled |
| CSP | String policy | Object policy, stricter default |
| Request blocking | webRequestBlocking | declarativeNetRequest |
| Browser support | Legacy, being removed | Current Chromium model |
Related pages:service worker vs background pageextension CSP
What did not change
V3 does not remove host permissions, cookies, history, debugger, nativeMessaging or content scripts. A V3 extension can still request all_urls and read page content where it runs. It can still send data to external servers.
A V2 extension can be carefully designed and transparent. The manifest version is a platform fact, not a safety rating.
Related pages:what does all_urls meanare Chrome extensions safe
What to review in either version
Check host access, content scripts, sensitive API permissions, external domains, remote code indicators and the update URL. Review the CSP for relaxations. Re-check after major updates.