Manifest V3 and Content Blocking

## Why it matters

In 2024, Chrome finished the shift from Manifest V2 to Manifest V3. This was not a small change. It altered how extensions block adverts and trackers.

The old way: the extension watched every request your browser made. It could see where you went and what you did. That gave ad blockers real-time precision. They could make decisions on the fly. The downside was that ad blockers needed your full browsing history to work. They asked for "access to your data on all websites."

The new way: the extension provides Chrome with a ruleset once. Chrome applies those rules itself. The extension doesn't watch your requests. It never sees your browsing history. This means a Manifest V3 ad blocker can work without needing sensitive permissions. Privacy went up. The trade-off was that blockers lost the ability to watch requests in real time, but for most ad blocking purposes, static rules work fine.

Scalpel is built on this new model. It blocks without watching.

## How it works

Manifest V3 deprecated the webRequest API, which acted like a middleman: every request flowed through it, and extensions could inspect and modify requests on the fly. In its place, Chrome introduced declarativeNetRequest.

With declarativeNetRequest, the flow is:

1. The extension builds a ruleset in JSON format. Each rule says: "If a request matches this URL pattern and these conditions, block it (or allow it)."
2. At install time, the extension gives Chrome the ruleset.
3. Chrome reads the ruleset once and applies it to every future request.
4. The extension never gets involved in request processing.

This is fundamentally different. The old webRequest model was watch-and-decide. The new declarativeNetRequest model is provide-rules-once. Chrome does the work, not the extension.

Because the extension doesn't intercept requests, it never needs to see your traffic history. It doesn't ask for "access to all sites." It only needs permission to modify how Chrome processes requests, which doesn't require browsing history.

## What does not matter

Manifest V3 did not kill ad blocking, despite the headlines. It changed the mechanism, and some things became harder (live per-request logging is limited now), but blocking works just fine. Static rulesets can cover the overwhelming majority of adverts and trackers. Edge cases exist, but they're rare.

Live request logging is the real limitation. In Manifest V2, an ad blocker could see every request in real time and log it. In Manifest V3, Chrome lets an extension ask "What rules did you match on this page?" only when the user opens the popup, and only for the active tab. Scalpel works around this by reading the matched-rule count only when you click the icon. That's why the badge updates when you open the popup, not continuously.

Regex rules (patterns with regex syntax instead of simple string matching) are limited in Manifest V3. Chrome allows only 1,000 regex rules per extension to avoid performance impact. Scalpel doesn't rely on regex blocking, so this limit doesn't affect it.

## Code example

In Manifest V2, an ad blocker might have done this:

// Manifest V2: watch every request in real time
chrome.webRequest.onBeforeRequest.addListener(
  function(details) {
    if (details.url.includes("ads.adnetwork.com")) {
      return { cancel: true };  // Stop this request
    }
  },
  { urls: ["<all_urls>"] }  // Listen to all requests
);
Copy

This required the extension to have access to all your browsing data.

In Manifest V3, it looks different:

{
  "id": 1,
  "priority": 1,
  "action": {
    "type": "block"
  },
  "condition": {
    "urlFilter": "||ads.adnetwork.com^"
  }
}
Copy

This rule gets bundled into a static ruleset. Chrome reads it once and applies it everywhere. The extension never watches requests. The ruleset is auditable: you can read it and verify what the extension actually blocks.

## How Scalpel Ads Blocker shows it

Scalpel is entirely built on Manifest V3 from the ground up. It doesn't ask for access to your browsing history. It asks for permission to use the declarativeNetRequest API, which Chrome handles internally.

The blocked-request count you see in the popup comes from the getMatchedRules API, which only works when you open the popup. This means Scalpel counts blocks on the page you're currently viewing, on your click, not continuously in the background. It's honest about this limitation.

In settings, Scalpel lets you enable or disable entire rulesets (like EasyPrivacy, which targets trackers). Enabling a ruleset adds its rules to Chrome's active pool. Disabling it removes them. All of this happens locally, on your device, with Chrome as the enforcer. Scalpel never learns which sites you visit.

The extension's code is open source. The rulesets are transparent. The mechanism is simple: provide rules to Chrome, Chrome does the filtering, no extension access to your history.