Manifest V3 Network Rules

Chrome Extension declarativeNetRequest: How it works & why ad-blockers use it.

Understand Chrome Manifest V3 declarativeNetRequest vs webRequest. Learn how browser-evaluated declarative rules protect privacy and why Vezz me needs neither.

Best fit

Best for privacy-conscious users and developers auditing network-interception permissions in Manifest V3 browser extensions.

Technical Manifest Audit

Permission specification & risk profile.

Review how Chrome enforces declarativeNetRequest in Manifest V3 and how to tell legitimate user-triggered extensions apart from intrusive tools.

Risk level: MediumdeclarativeNetRequest
Chrome install-time warning
Block content on any page / Modify network requests
Manifest V3 declaration
// manifest.json (Rule-based ad-blockers / privacy extensions)
{
  "name": "Content Blocker Example",
  "permissions": ["declarativeNetRequest"],
  "declarative_net_request": {
    "rule_resources": [{
      "id": "ruleset_1",
      "enabled": true,
      "path": "rules.json"
    }]
  }
}
Legitimate uses vs. red flags
What to verify before granting this permission to an AI browser tool.

Legitimate AI reading uses

  • Blocking ad trackers, malware domains, and telemetry URLs using browser-evaluated rules (e.g. uBlock Origin Lite)
  • Stripping tracking query parameters (like `fbclid`, `gclid`, `utm_*`) from URLs without reading payload contents
  • Upgrading HTTP requests to HTTPS via URL redirection rules

Red flags to watch for

  • Modifying request or response headers to bypass CORS policies for arbitrary domains without disclosure
  • Redirecting search queries or affiliate URLs to third-party monetized affiliate tags
  • Using dynamic rules to strip security headers (CSP, X-Frame-Options) on banking or enterprise pages
How Vezz me handles this: Vezz me does NOT declare `declarativeNetRequest` or `webRequest`. It does not intercept, inspect, redirect, or block network traffic. All AI queries are initiated directly from the extension runtime via standard HTTPS fetch to our API.
Step-by-step workflow

How to run this workflow in place.

1

Understand why Manifest V3 introduced declarativeNetRequest

In Manifest V2, `webRequestBlocking` gave extensions direct access to view and modify every byte of HTTP traffic. `declarativeNetRequest` moves rule execution to the browser engine, preventing extensions from reading sensitive payload bytes.

2

Audit whether an AI reading tool actually needs network rules

Ad blockers and tracking strippers legitimately require `declarativeNetRequest`. A reading comprehension extension that answers questions about highlighted text has zero legitimate need for it.

3

Verify Vezz me's manifest permissions

Inspect `manifest.json` in Vezz me: you will find only `activeTab` and `storage`—zero network interception capabilities.

Key details

Why this approach works better than switching tabs.

declarativeNetRequest vs webRequest: The technical difference
Chrome Manifest V3 radically restructured how browser extensions interact with network traffic.
  • **`webRequest` (V2/V3)**: Passively observes or intercepts network packets in extension code—exposing request bodies and headers to the extension's service worker
  • **`declarativeNetRequest` (V3)**: The extension supplies declarative regex/URL rules, but the browser engine executes them internally without passing packet data to the extension
  • **AI Reading Extensions**: Neither permission is needed for an extension that only analyzes text highlighted on screen by the user
Comparison Matrix

Network Permissions Comparison

Comparing declarativeNetRequest with webRequest and activeTab.

PermissionCan Read Traffic Payloads?Browser Warning on Install
declarativeNetRequestNo (browser evaluates rules internally)Shows 'Block content on any page' or requires host_permissions for redirects
webRequest / webRequestBlockingYes (extension inspects live request headers/bodies)Shows 'Read and change all your data on all websites'
activeTab (Vezz me)Zero network interception capabilityNo install warning banner at all
Frequently asked questions

Common questions about manifest v3 network rules.

Can an extension with declarativeNetRequest steal my passwords?

Generally no, because the extension cannot read response bodies or form submissions directly through declarativeNetRequest. However, if paired with broad host permissions, an extension could redirect requests or alter security headers.

Why does uBlock Origin use declarativeNetRequest in Manifest V3?

uBlock Origin Lite uses declarativeNetRequest because Chrome Manifest V3 deprecated the blocking version of webRequest for standard extensions.

Where can I audit my installed extensions?

Visit our free AI Chrome Extension Permission Checker tool to inspect any extension's manifest permissions.

Related workflows & guides

Explore connected pages.

webRequest Permission Security Audit
Why webRequest interception is heavily scrutinized.
Open guide
Host Permissions (<all_urls>) Audit
The #1 security risk in browser extensions.
Open guide
AI Chrome Extension Permission Checker
Interactive permission auditing tool.
Open guide
activeTab Permission Security Guide
Why user-gesture activeTab is the gold standard for privacy.
Open guide
All Extension Security & Permissions
Browse the complete directory of extension security & permissions on Vezz me.
View hub directory
Available for Chrome and Firefox

Ready to try this workflow on your own reading?

Install Vezz me free, highlight text on any webpage, and press your customizable shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on Mac) to get an answer right beside the source.

Install free for ChromeInstall free for FirefoxCompare plans