Microsoft Edge Manifest V3 Blocks Remotely Hosted Extension Code to Improve Security

Microsoft has announced plans to fully retire Manifest V2 (MV2) browser extension support in Microsoft Edge by early 2027, completing a transition to the more restrictive Manifest V3 (MV3) extension platform.

The move is intended to improve browser security and performance by imposing stricter permission controls and preventing extensions from executing remotely hosted code.

According to Microsoft, the enterprise deprecation process will begin globally in early January 2027 and is expected to finish by late April 2027. The retirement will affect Edge users on Windows, macOS, and Linux across Canary, Dev, Beta, and Stable channels.

Microsoft Edge Manifest V3 Blocks Remotely Hosted Extension Code

Manifest V2 has long been used by browser extensions to access powerful APIs, including web request interception capabilities. However, the older extension framework permits certain designs that can introduce security and governance risks.

One major concern is remotely hosted code, where an extension can download and execute JavaScript or other logic from an external server after installation.

This approach creates an opportunity for extension behavior to change without a corresponding update being reviewed through the browser’s add-on store.

If an extension developer’s infrastructure is compromised, or if a legitimate extension is later sold to an untrusted party, remotely loaded code could potentially be altered to collect browser data, inject unwanted content, modify web traffic, or deliver malicious functionality.

Manifest V3 addresses this issue by blocking remotely hosted code and requiring executable extension logic to be packaged with the extension. This gives browser platforms and users greater visibility into the code delivered during installation or update.

MV3 also introduces stricter permissions and a service worker-based background execution model designed to reduce persistent resource usage and lower the attack surface associated with legacy extensions.

Microsoft said MV2 extensions will start displaying deprecation warnings in the Edge Manage Extensions page at edge://extensions and on Microsoft Edge Add-ons product pages.

For consumer users, MV2 extensions will be disabled by default during the rollout. Initially, users may be able to manually re-enable affected extensions, but Microsoft said that option will be phased out over time.

Enterprise-managed devices will receive a temporary exception during the consumer rollout through the ExtensionManifestV2Availability policy.

This policy can allow organizations to retain MV2 support while they migrate applications and extension deployments. However, the policy will be removed once enterprise deprecation begins, meaning MV2 extensions will stop functioning on all devices, including managed endpoints.

The change has significant implications for enterprise security teams that force-install or allow-list browser extensions through policies such as ExtensionInstallForcelist and ExtensionInstallAllowlist.

Organizations should inventory their current Edge extension environment, identify all MV2 dependencies, and determine whether an MV3 version is already available through the Edge Add-ons store.

Internal line-of-business extensions require particular attention. Development teams must migrate MV2 manifests, permissions, background scripts, and network-request handling to MV3-compatible designs before the enterprise deadline.

Administrators should also update deployment policies to reference replacement MV3 extension IDs and communicate the upcoming change to employees, helpdesk teams, and third-party extension vendors.

By completing the migration before early 2027, organizations can avoid browser-extension outages while gaining stronger control over extension code, permissions, and runtime behavior.

Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN

The post Microsoft Edge Manifest V3 Blocks Remotely Hosted Extension Code to Improve Security appeared first on Cyber Security News.