---
title: "Chrome Extension declarativeNetRequest: How it works & why ad-blockers use it."
description: "Understand Chrome Manifest V3 declarativeNetRequest vs webRequest. Learn how browser-evaluated declarative rules protect privacy and why Vezz me needs neither."
canonical_url: "https://vezz.me/permissions/declarativenetrequest/"
type: "pseo-permissions"
category: "permissions"
topic: "Manifest V3 Network Rules"
intent: "Best for privacy-conscious users and developers auditing network-interception permissions in Manifest V3 browser extensions."
---

# Chrome Extension declarativeNetRequest: How it works & why ad-blockers use it.

Understand Chrome Manifest V3 declarativeNetRequest vs webRequest. Learn how browser-evaluated declarative rules protect privacy and why Vezz me needs neither.

> **Best fit:** Best for privacy-conscious users and developers auditing network-interception permissions in Manifest V3 browser extensions.

## Technical Permission Audit

- **Manifest Key:** `declarativeNetRequest`
- **Chrome Install Warning:** Block content on any page / Modify network requests
- **Risk Level:** Medium

```json
// manifest.json (Rule-based ad-blockers / privacy extensions)
{
  "name": "Content Blocker Example",
  "permissions": ["declarativeNetRequest"],
  "declarative_net_request": {
    "rule_resources": [{
      "id": "ruleset_1",
      "enabled": true,
      "path": "rules.json"
    }]
  }
}
```

### Legitimate Uses
- Blocking ad trackers, malware domains, and telemetry URLs using browser-evaluated rules (e.g. uBlock Origin Lite)
- Stripping tracking query parameters (like `fbclid`, `gclid`, `utm_*`) from URLs without reading payload contents
- Upgrading HTTP requests to HTTPS via URL redirection rules

### Red Flags to Watch For
- Modifying request or response headers to bypass CORS policies for arbitrary domains without disclosure
- Redirecting search queries or affiliate URLs to third-party monetized affiliate tags
- Using dynamic rules to strip security headers (CSP, X-Frame-Options) on banking or enterprise pages

**How Vezz me handles this:** Vezz me does NOT declare `declarativeNetRequest` or `webRequest`. It does not intercept, inspect, redirect, or block network traffic. All AI queries are initiated directly from the extension runtime via standard HTTPS fetch to our API.

## Step-by-step workflow

1. **Understand why Manifest V3 introduced declarativeNetRequest**: In Manifest V2, `webRequestBlocking` gave extensions direct access to view and modify every byte of HTTP traffic. `declarativeNetRequest` moves rule execution to the browser engine, preventing extensions from reading sensitive payload bytes.
2. **Audit whether an AI reading tool actually needs network rules**: Ad blockers and tracking strippers legitimately require `declarativeNetRequest`. A reading comprehension extension that answers questions about highlighted text has zero legitimate need for it.
3. **Verify Vezz me's manifest permissions**: Inspect `manifest.json` in Vezz me: you will find only `activeTab` and `storage`—zero network interception capabilities.

## declarativeNetRequest vs webRequest: The technical difference

Chrome Manifest V3 radically restructured how browser extensions interact with network traffic.

- **`webRequest` (V2/V3)**: Passively observes or intercepts network packets in extension code—exposing request bodies and headers to the extension's service worker
- **`declarativeNetRequest` (V3)**: The extension supplies declarative regex/URL rules, but the browser engine executes them internally without passing packet data to the extension
- **AI Reading Extensions**: Neither permission is needed for an extension that only analyzes text highlighted on screen by the user

## Network Permissions Comparison

Comparing declarativeNetRequest with webRequest and activeTab.

| Permission | Can Read Traffic Payloads? | Browser Warning on Install |
| --- | --- | --- |
| declarativeNetRequest | No (browser evaluates rules internally) | Shows 'Block content on any page' or requires host_permissions for redirects |
| webRequest / webRequestBlocking | Yes (extension inspects live request headers/bodies) | Shows 'Read and change all your data on all websites' |
| activeTab (Vezz me) | Zero network interception capability | No install warning banner at all |

## Frequently asked questions

### Can an extension with declarativeNetRequest steal my passwords?

Generally no, because the extension cannot read response bodies or form submissions directly through declarativeNetRequest. However, if paired with broad host permissions, an extension could redirect requests or alter security headers.

### Why does uBlock Origin use declarativeNetRequest in Manifest V3?

uBlock Origin Lite uses declarativeNetRequest because Chrome Manifest V3 deprecated the blocking version of webRequest for standard extensions.

### Where can I audit my installed extensions?

Visit our free AI Chrome Extension Permission Checker tool to inspect any extension's manifest permissions.

## Related guides

- [webRequest Permission Security Audit](https://vezz.me/permissions/webrequest/): Why webRequest interception is heavily scrutinized.
- [Host Permissions (<all_urls>) Audit](https://vezz.me/permissions/host-permissions-all-urls/): The #1 security risk in browser extensions.
- [AI Chrome Extension Permission Checker](https://vezz.me/ai-chrome-extension-permission-checker/): Interactive permission auditing tool.
- [activeTab Permission Security Guide](https://vezz.me/permissions/activetab/): Why user-gesture activeTab is the gold standard for privacy.