Extenshiextenshi.io/blog
Back to articles
manifest-v2chrome-web-storeextension-securitybrand-impersonationabandoned-extensions

Manifest V2 extensions are delisted: how to replace yours without installing a clone

Chrome removed the last Manifest V2 extensions from the Web Store on August 31. What happens to yours now — and how to vet a replacement before you install it.

Maxim Kosterin
9 min read

There's a decent chance you have a greyed-out extension sitting in chrome://extensions right now, one you've been meaning to deal with since last summer. As of the end of August, Chrome delisted the last Manifest V2 extensions from the Web Store, and the store page that would have told you what it was is gone too. The extension isn't the problem — it's been dead for over a year. The problem is what you're about to install instead.

What actually happened to Manifest V2 extensions on August 31

Google's Manifest V2 support timeline set August 31, 2026 as the date all remaining MV2 extensions are removed from the Chrome Web Store. Not disabled — that already happened. Removed from the listings.

The distinction matters more than it sounds. Google's own wording: "Manifest V2 extensions installed on Chrome 138 or earlier will remain installed, but will be unable to receive any updates and cannot be reinstalled from the Chrome Web Store once removed from Chrome."

So the timeline, in plain terms:

  • March 2025 — MV2 extensions disabled by default, users could still flip them back on.
  • July 2025 (Chrome 138) — disabled on every channel, no way to re-enable. This is when your extension actually stopped working.
  • Chrome 139 — the enterprise escape hatch, the ExtensionManifestV2Availability policy, was removed. Companies that had been holding the line lost it all at once.
  • August 31, 2026 — the listings themselves disappear.

Your extension didn't die at the end of August. It died in July 2025. What the delisting removed is the paper trail: the store page, the description, the permission list, the reviews, the developer's contact link. If you were relying on "I'll look it up later," later just expired.

Can you still enable Manifest V2 extensions?

No. March 2025 was the last point where flipping MV2 back on took one click, and every path out of it has since been closed: Chrome 138 turned the disable on for every channel in July 2025, and Chrome 139 removed the enterprise ExtensionManifestV2Availability policy that a few corporate deployments had been holding on to. There is no flag left to flip and no policy left to set.

So whatever still runs MV2 on your machine is frozen, and it can't receive updates. That's exactly why this post isn't about revival. The live question is what you install in its place.

The three-quarters of this that's genuinely boring

I don't want to oversell this. When I counted what the MV2 sunset actually removed back in June, the headline finding was that the panic had it backwards: every ad blocker we track on the Chrome Web Store had already shipped an MV3 build. The roughly 6,000 stranded Chrome listings in our catalog were overwhelmingly abandonware. Classroom tools, old productivity add-ons, things whose developers stopped answering email years ago. And most of them were already marked unavailable before the deadline.

If you're a normal Chrome user, the probability that August 31 broke something you use today is very low. Your blocker updated itself months ago and you never noticed.

So why write about it? Because of the last quarter.

The part that's actually risky: you're now shopping

Delisting doesn't delete demand. A few hundred thousand people had a workflow built around some niche MV2 utility, and that utility is now unrecoverable — not "reinstall it and hope," genuinely gone. Those people do the obvious thing: they open the Chrome Web Store and search for the name of the thing they lost.

That search behaviour is the attack surface, and it's a well-documented one.

Socket's threat research team found 737 Chrome listings impersonating well-known VPN brands — Proton, Nord, Surfshark, ExpressVPN — that quietly configured Chrome to route browser traffic through SOCKS5 proxies operated by a single party. The extensions weren't broken. They worked exactly as built, just not for the person who installed them.

BleepingComputer's write-up noted that hundreds remained listed even after Google pulled the first wave. I went through the whole campaign in the fake VPN extensions piece.

Same playbook, smaller scale, on the crypto side: Socket also documented a fake imToken extension that used a homoglyph in its name — characters that look identical to the real ones at 13 pixels — and existed to collect seed phrases. If you're scanning a results page rather than reading it, homoglyphs win every time.

Neither of those campaigns needed the MV2 sunset. But both depend on exactly the state it creates: a user who knows the name of what they want, doesn't have the original listing to compare against, and is in a hurry.

Why this matters for you

Here's the uncomfortable bit. When you install a replacement, you're not just trusting new code — you're usually granting it the same permissions the old one had, because it does the same job. A dead screenshot tool needed <all_urls>. Its replacement will ask for <all_urls> too, and you'll click accept, because the request looks reasonable for the category.

That's the whole trick. Impersonators don't need to over-ask. They need to ask for precisely what you already expect to give.

And the ownership angle makes it worse: a name that's been dormant for a year carries residual trust with none of the residual scrutiny. I wrote about what happens when a legitimate extension changes hands — the audience transfers with the listing, and nobody re-reads the permissions on an extension they already have. The delisting version of that problem is the same trust, transferred to a stranger, via search.

How to vet a replacement in about five minutes

None of this needs tooling. It needs five checks, in this order.

1. Go to the maintainer before you go to the store. The single best outcome is that the original developer shipped an MV3 successor themselves — as uBlock Origin did, where the classic build left Chrome and uBlock Origin Lite arrived as a separate MV3 tool from the same author. Search the developer's name or the project's GitHub first. If there's an official successor, the store search is a detour that can only hurt you.

2. Read the publisher line, not the extension name. The name is the part that gets faked; the publisher and the linked website are harder to fake convincingly. Check that the listed website is a domain that actually belongs to the vendor, not a lookalike, and that it existed well before the delisting. This is where the homoglyph trick dies — a substituted character in a display name survives a glance, but the publisher's domain usually doesn't match.

3. Look at review dates, not review counts. A listing with 40,000 users and 4.8 stars sounds settled until you notice every review landed inside the same three weeks. Real extensions accumulate reviews unevenly over years, with complaints mixed in. A clean, dense, recent block is a pattern worth walking away from.

4. Compare the permissions to the job. Ask what the feature genuinely requires, then read the install prompt against that. A note-taking replacement has no business requesting proxy configuration, and a tab manager doesn't need to read data on every site. If you're unsure what a specific permission actually allows, that's most of what this blog's permission explainers exist for.

5. Check the data disclosure — it's enforceable now. Since August 1, 2026 the Chrome Web Store's updated policies require that any data an extension collects be strictly necessary to its disclosed single purpose, and that collection be prominently disclosed regardless. Developers must also proactively notify users when their data practices change after install. A listing with a blank or boilerplate data-use section isn't just sloppy any more; it's out of step with the rules the store says it enforces — a usable signal.

And a sixth, unglamorous option: don't replace it. Chrome absorbed a lot of what 2019-era extensions did — tab search, reading list, PDF handling, per-site permissions. Check whether the browser already does the thing before you hand a stranger <all_urls>.

If you can't even remember what it was

This is the practical cost of the August 31 delisting: the store page that would have jogged your memory is gone.

Open chrome://extensions, turn on Developer mode, and the extension ID is still there under each entry — a 32-character string. That ID is the durable handle. Our catalog keeps historical listings, including manifest and permission snapshots for versions that are no longer live. An ID you can't resolve in the store may still resolve into "here's what it declared and what it asked for." That's usually enough to decide whether you need a replacement at all, or whether you can just remove the entry and move on.

If you'd rather do it locally, npx @extenshi/guard scan reads what's actually installed in your browsers and reports on it — no account needed for the scan.

How Extenshi helps

We snapshot extension listings across Chrome, Firefox and Edge continuously: manifest version, declared permissions, publisher, update history. A delisted extension doesn't become a blank in our data the way it does in the store. It also means that when a "replacement" shows up wearing a familiar name, the publisher, age and permission profile are things you can look at side by side instead of guessing at.

The five checks above are the version you can do by hand. This is the version that runs on 300,000+ listings so you don't have to.

Scan your extensions →

Sources

This article is based on publicly available security research, official vendor documentation, and Extenshi's first-party catalog data. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If any entity referenced in this article believes information is inaccurate, contact [email protected] and we will review and update.

Related Articles