The current API is a security hole.
But that's fine. "It's incumbent on end-users to know what they're installing" is a fine position for Mozilla to take.
But that's fine. "It's incumbent on end-users to know what they're installing" is a fine position for Mozilla to take.
Which direction are taking it?
The owner of a walled garden doesn’t need to depend on 3rd parties for anything they can build whatever tools they want in house.
As long as ad networks allow arbitrary code to run, and content designed to trick users, I prefer to centralize on a single source of potential risk (the extension developer) rather than the moving target of malicious ads from myriad sources.
A recent example readily avoided by not allowing the ad to run in the first place: https://www.securityweek.com/webkit-zero-day-vulnerability-e...
"uBlock" stole the new from gorhill.
How does that solve the security issue you mentioned?
webRequest API, because it runs arbitrary JS, could do anything including something malicious by modifying external JS after the extension was submitted to the store. It's an API that makes it impossible for a store to make security guarantees at all.
This is, unfortunately, the behavior ad blockers rely upon to keep their databases of malicious actors fresh.
The declarative API solves that by not allowing page modification outside of safety boundaries like deleting elements.
https://stackoverflow.com/questions/3274144/can-i-modify-out...
Saying that manifest v3 is about security is really not credible. Maybe the changes look like security, but the details are simply not consistent with security being the primary goal.