Manifest V2 is gone. This is what a Chrome extension looks like now

The long goodbye to Manifest V2

Manifest V3 changed how Chrome extensions are built: background pages became service workers, remotely hosted code was banned, and network blocking moved to a declarative API. Google gave developers four and a half years to move. On 31 August 2026, the last remaining Manifest V2 extensions were removed from the Chrome Web Store. Copies already installed on old versions of Chrome keep running, but they can no longer be updated or reinstalled.

1. January 2022No new public MV2 extensionsThe store stops accepting them.
2. 3 June 2024Warnings beginA banner on chrome://extensions in Beta, Dev and Canary.
3. 9 October 2024Stable starts switching them offUsers are pointed to MV3 alternatives.
4. 31 March 2025Off by default everywhereUsers can still turn them back on, for now.
5. 24 July 2025Chrome 138 disables them for allNo way back for users.
6. 31 August 2026Removed from the Chrome Web StoreNo updates, no reinstalls.

The rules that took effect on 1 August

A month before the removal, the Chrome Web Store tightened what an extension may do with the data it sees. Enforcement began on 1 August 2026.

Why the rules got stricter

In April 2026, researchers at Socket reported more than 100 malicious extensions in the official Chrome Web Store, published under five different developer identities and all talking to the same command-and-control servers. They looked ordinary: Telegram sidebars, simple games, YouTube and TikTok enhancers, a translator. Here is what the clusters did.

The pattern is the lesson. None of these needed anything exotic. They asked for permissions that sound reasonable one at a time, such as the identity API or access to every site, and used them for something the listing never mentioned. That is exactly what the limited use and disclosure rules now forbid, and exactly what users can spot if they look at what an extension asks for.

Permissions are the product's first impression

When someone installs an extension, Chrome turns its permissions into plain-language warnings. Tick and untick the permissions below and watch what the install dialog would say. Then press the button to see how little most tools really need.

A highlighter, a colour picker or a page inspector usually needs activeTab and storage and nothing else: it only touches the page you deliberately click it on. Asking for less is not only safer, it converts better, because the install dialog is the moment people decide whether to trust you.

What is new for developers

The Chrome extensions team's I/O 2026 recap had a few changes that make day-to-day work nicer. The one you will feel most is the browser namespace.

browser.runtime.onMessage.addListener(async message => {
  if (message.type !== 'page-title') return;
  const [tab] = await browser.tabs.query({ active: true, currentWindow: true });
  return { title: tab.title };
});

• Every extension API under browser from Chrome 148, which makes code easier to share with other browsers. Extensions with a DevTools page get it from Chrome 152.
• Developer Dashboard roles: Viewer, Item manager, Editor and Admin, with members invited at no cost, replacing the old shared Google Group.
• Private publishing to another organisation, approved by that organisation's admin, for extensions built for one client.
• Chrome DevTools for agents can now install, reload and debug extensions, from the popup to the service worker.
• The team also said 17% of extensions created in the past year use AI, and monthly developer registrations have more than doubled.

A trustworthy extension in 2026

What I check before publishing any extension. Your ticks stay in this browser.

• Manifest V3, with all code in the package and nothing loaded from a server.
• The smallest permissions that work: activeTab before host access, optional permissions for rare features.
• One clear purpose, and data collection limited to it.
• A privacy section and policy that match the code, updated before any change ships.
• No innerHTML with outside data; build DOM nodes or use textContent.
• Team access through dashboard roles, not a shared login.