The fix, in one snippet
chrome://extensions > Details, or read manifest.jsonIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The analyser reads manifest_version. For a value of 2 it also reports the MV2-only constructs present: a persistent background.page or background.scripts, browser_action or page_action, webRequestBlocking, and a string CSP that admits remote hosts. The severity is low because the format itself is not a vulnerability. Context matters by browser: Chrome disabled Manifest V2 extensions for users through 2024 and 2025 and has removed support, Edge followed Chromium, Firefox continues to support MV2 alongside MV3 (Mozilla has said it has no plan to remove blocking webRequest), and Safari supports both. Limits: this is a format check; it says nothing about what the code does.
Why it matters
Manifest V2 permitted remotely hosted code, eval in extension pages and always-on background pages; Manifest V3 requires packaged code, a fixed CSP and event-driven service workers. An MV2 package in 2026 is either built for Firefox, where that is fine, or unmaintained. Unmaintained extensions are the ones whose script domains expire and whose developer accounts get sold or phished. Chrome users who force MV2 through enterprise policy or sideloading are running code the store no longer reviews.
How to fix it
Users on Chrome or Edge: if an extension was disabled for being MV2, look for the developer's MV3 version or an equivalent (for content blocking, uBlock Origin Lite is the MV3 successor to uBlock Origin); do not sideload old packages. Firefox users: MV2 is supported; check the last-updated date on the AMO listing instead.
Developers: migrate. The main changes are a service worker instead of a background page, host_permissions split from permissions, action instead of browser_action, declarativeNetRequest for blocking, and the scripting API:
"manifest_version": 3,
"action": {"default_popup": "popup.html"},
"background": {"service_worker": "bg.js"},
"host_permissions": ["https://*.example.com/*"]Guides: how Manifest V3 changed ad blockers and are browser extensions safe?
Where this fits
Extension uses Manifest V2 is check 8 of 9 that the browser extension analyzer runs under extension permissions and behaviour, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Extension weakens its Content-Security-Policy (medium), where the extension's content_security_policy loosens the default protections, permitting inline scripts, eval or remote scripts inside the extension's own pages. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Extension uses Manifest V2 closes one route in. The next one down is Extension declares optional permissions, where the extension declares optional permissions or optional host permissions that it can request later at runtime.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Extension uses Manifest V2 (low severity)
Scanner check id: extension-manifest-v2The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 04, 2026
How Ad Blockers and Tracker Blockers Work (and Why Manifest V3 Changed Them)
A content blocker matches every request against filter lists and stops the ones that serve ads or trackers. Filter lists, cosmetic...
Read the guide
7 min read · Updated Sep 10, 2026
Are Browser Extensions Safe? How to Audit What You Have Installed
Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...
Read the guide