Browser extension

Permissions are declared in a manifest and granted once. With the usual reading permission an extension sees the address of every tab and the text inside it.

• The page

  It inserts scripts and styles into a site and changes what you see there.

• The traffic

  It blocks or redirects requests by declared rules the browser applies in its own network stack.

• Storage of its own

  It keeps data that survives a restart and belongs to the profile it runs in.

• Nothing past the browser

  Your disk and your other programs are outside the sandbox the browser draws.

The manifest declares what an extension is and what it may do. The third generation moved background pages to service workers and blocking to declared rules.

Current Chromium refuses the older generation outright. Here that refusal happens twice: at install and again before a profile starts.

• Refused at install

  A manifest that is not third generation stops the install with a plain reason instead of a green result.

• Skipped at launch

  A folder of the older kind is left out and a notification names the folder and the profile.

• Why the refusal is spoken

  A browser handed such a folder starts and then loads no page at all, so silence would read as a broken product.

Extensions are part of what a site can read about a browser. Most of them leave marks that need no permission to find.

• Files a page may ask for

  An extension declares resources the page can load, and asking for one by name answers whether it is there.

• Changes in the document

  Inserted elements, rewritten styles and adverts that never appear are all visible to the page itself.

• Requests that never happen

  A blocked request fails differently from a slow one, and a page can time it.

• The rare set is the mark

  A common blocker says little about you. An unusual combination narrows you down like any rare value.

Switching an extension on is remembered for one profile by the name of its folder. Signed in, the same choice reaches your account, so the profile carries it to a second machine.

The files themselves stay local and are shared by every profile, so one version of an extension serves all of them.

• Up to fifty per profile

  Past that the switch refuses and says why, rather than accepting a choice the launch would ignore.

• Only what you enabled

  The launch hands the browser that list together with a matching refusal list, so nothing else loads beside it.

• Turning one off acts now

  It leaves the running session instead of waiting for the app to be restarted.

On our own engine the tracker blocking and the link cleaning arrive as a small extension built for the profile at launch. Its rules come from the same source the fallback engine uses, so the two cannot drift apart.

Blocking happens inside the network stack. Nothing is hooked where a page can see it, and no request waits on our process.

• A user script

  It runs inside a page through a host extension and holds no permissions of its own.

• A plugin

  The old binary kind is gone from this browser family. What remains is web code in a sandbox.

• A profile

  An extension is code that runs in a profile. The profile is the identity it runs under.