Why Chromium Banned Remotely Hosted Code in Manifest V3

The transition to Manifest V3 in the Chromium web browser introduced a strict prohibition on remotely hosted executable JavaScript code within browser extensions. This article explores the primary reasons behind this major architectural shift, focusing on how the ban mitigates malware threats, prevents post-review code manipulation, enhances user privacy, and improves the reliability of the extension review process.

The Vulnerability of Remotely Hosted Code

Under the previous Manifest V2 standard, browser extensions could download and execute JavaScript files directly from external servers controlled by the developer. They could also use functions like eval() to execute strings of text as code. While this allowed developers to update their extensions quickly without waiting for store approval, it created a massive security blind spot. The code running on a user's browser could be completely different from the code that was originally approved by the browser's extension store.

Preventing "Bait-and-Switch" Malware Attacks

The primary reason Chromium banned remotely hosted code is to stop malicious "bait-and-switch" tactics. Under Manifest V2, bad actors frequently submitted harmless, fully compliant extensions to the Chrome Web Store. Once the extension passed the security review and gained a large user base, the attacker would update the JavaScript file on their private server to include malicious code.

Because the extension automatically fetched this remote code, millions of users were instantly infected with malware, adware, or cryptocurrency miners without ever updating the extension through the store. By requiring all executable code to be bundled inside the extension package itself, Manifest V3 eliminates this attack vector.

Protecting Against Compromised Developer Servers

Even when extension developers have good intentions, their external infrastructure can be a weak point. In the past, hackers have targeted the private servers of legitimate developers. If an attacker gained access to a server hosting an extension's remote JavaScript, they could inject malicious scripts into that file. The legitimate extension would then unknowingly distribute malware to its users. Bundling all code within the extension package removes the reliance on the security of third-party servers.

Increasing the Accuracy of Store Reviews

For the Chrome Web Store to protect users, its automated systems and human reviewers must know exactly what an extension is capable of doing. When code is hosted remotely, reviewers can only see a snapshot of the extension's behavior at the exact moment of the review.

By prohibiting remote code execution, Chromium ensures that the extension package submitted to the store contains the entirety of the logic that will ever run on a user's device. This allows security auditors to definitively analyze the extension's behavior, making the review process faster, more predictable, and significantly more effective.

Enhancing User Privacy

Remotely hosted code was frequently abused to bypass privacy policies. Extensions could dynamically load tracking scripts to harvest user browsing history, session tokens, and personal data, sending it back to unauthorized third parties. Because these scripts were only loaded under specific conditions dictated by a remote server, they were difficult for privacy researchers to detect. Forcing all code to be local makes it much easier for both browser vendors and independent researchers to audit extensions for unauthorized data collection.

How Extensions Update in Manifest V3

To maintain functionality without remotely hosted code, Chromium introduced safer alternatives in Manifest V3. Developers can still fetch remote data, such as JSON configuration files, to change how their existing, pre-approved code behaves. For ad blockers and security extensions that rely on constantly changing filter lists, Chromium introduced the declarativeNetRequest API, which allows extensions to update rules dynamically without executing arbitrary, unverified JavaScript. If a developer needs to change the actual executable logic of the extension, they must submit a new version to the store for review.