Microsoft Edge Retires Manifest V2 Extensions, Disabling Popular Privacy Tools
What Happened — Microsoft announced the retirement of Manifest V2 (MV2) extensions in Edge, beginning this month. By the end of 2026 consumer extensions will be disabled by default, and enterprise extensions will follow in early 2027. The move forces privacy‑focused extensions (e.g., uBlock Origin, Malwarebytes Browser Guard) to redesign for Manifest V3 or lose key request‑modification capabilities.
Why It Matters for Compliance & Audit Readiness
- The loss of a privacy‑blocking extension creates a control gap in your web‑filtering and data‑exfiltration defenses, directly impacting SOC 2 CC6.1 (System Operations) and CC7.1 (Protection) requirements.
- Continuous‑compliance programs must map the removed capability to an alternative control, capture evidence of the new implementation, and retain a defensible audit trail.
- Verisq’s Control Mapping capability automates the identification of such gaps, tracks remediation, and supplies audit‑ready evidence for SOC 2 assessments.
Who Is Affected – SaaS browsers, endpoint‑security vendors, and any organization that relies on third‑party privacy extensions for web protection (tech‑SaaS, fintech, media, etc.).
Recommended Actions
- Inventory all MV2 extensions in use across your organization and classify the security controls they provide.
- Map each lost capability to an alternative control (e.g., DNS‑level filtering, secure web gateway, updated MV3 extensions).
- Document the remediation plan and collect configuration evidence to satisfy SOC 2 control testing.
Source: Malwarebytes Labs
Technical Notes – The shift replaces long‑running background scripts with service‑worker‑based declarative rules. MV3 imposes static rule limits (minimum 30 k rules, max 100 rule‑sets, 5 k session rules). Extensions that rely on persistent background activity must be rewritten. Source: Microsoft Edge documentation