Microsoft Ends Manifest V2 Extension Support, Shifts to More Secure V3

Key Takeaways

• Microsoft is phasing out Manifest V2 extension support in Edge by early 2027.
• The transition to Manifest V3 aims to enhance browser security, improve performance, and reduce risks from outdated extension code.
• The deprecation impacts all Microsoft Edge desktop users across Windows, macOS, and Linux, including consumer and enterprise environments.
• Developers and IT administrators must migrate existing Manifest V2 extensions to Manifest V3 or find suitable replacements before the deadline.

Microsoft has announced its intention to discontinue support for Manifest V2 browser extensions within Microsoft Edge, with a full transition to Manifest V3 expected by early 2027. This strategic move is designed to bolster browser security, optimize performance, and mitigate vulnerabilities inherent in older extension architectures.

The company communicated this significant policy shift via Message Center notification MC1467356 on September 4, 2026. The phased rollout for enterprises is slated to commence in early January 2027 and conclude by late April 2027.

This deprecation will impact Microsoft Edge users on desktop platforms, including Windows, macOS, and Linux, across all channels: Canary, Dev, Beta, and Stable. Manifest files are fundamental to extensions, defining their capabilities, permissions, background processes, and overall operational behavior within the browser environment.

Shifting to a More Secure Extension Architecture

For many years, Manifest V2 has been the standard for browser extensions, offering developers extensive access to browser resources. While this flexibility has been beneficial for innovation, it also presents security challenges, particularly when extensions request broad permissions or incorporate remotely loaded code, creating potential attack vectors.

Manifest V3 introduces a more stringent security model specifically engineered to mitigate these risks. Microsoft said the updated framework imposes stricter permission requirements, prohibits the execution of remotely hosted code, and significantly reduces the attack surface associated with legacy Manifest V2 extensions. Furthermore, Manifest V3 redesigns how extensions handle background tasks, contributing to reduced resource consumption and improved overall browser performance.

Impact on Consumers and Enterprises

During the consumer deprecation phase, Manifest V2 extensions will trigger warnings on the Edge Manage Extensions page (accessible via edge://extensions) and on their respective product pages within the Microsoft Edge Add-ons store. Microsoft will also remove these extensions from search results in the Add-ons store and block new installations. Initially, consumers may have the option to manually re-enable disabled Manifest V2 extensions; however, Microsoft clarified that this capability will progressively disappear as the deprecation advances. Eventually, Manifest V2 extensions will cease to function entirely in Edge.

Enterprise environments will receive a temporary reprieve during the initial consumer rollout. Administrators can leverage the ExtensionManifestV2Availability policy to maintain Manifest V2 support on managed endpoints where necessary. This policy, however, will be revoked once enterprise deprecation begins, rendering all Manifest V2 extensions inoperable, even on devices previously configured to allow them.

This change will directly affect organizations that deploy extensions through policies such as ExtensionInstallForcelist and ExtensionInstallAllowlist. IT administrators are strongly advised to inventory their deployed Manifest V2 extensions, identify available Manifest V3 alternatives, and update their deployment policies well in advance of the impending deadline.

Developer and Organizational Responsibilities

Microsoft has also urged developers to migrate both internal and commercially available extensions to Manifest V3. The Microsoft Partner Center will no longer accept updates for Manifest V2 extensions, though updates specifically designed to convert an existing Manifest V2 extension to Manifest V3 will still be processed. New Manifest V2 extension submissions have been blocked since July 2022.

Organizations should proactively inform affected users, particularly if a critical legacy extension lacks a direct Manifest V3 replacement. Security teams and helpdesk personnel should prepare for an increase in support inquiries as older extensions become disabled.

Microsoft’s notification underscores that all Manifest V2 migration efforts must be completed before enterprise deprecation commences, as no policy-based exceptions will be available thereafter.

What You Should Do

• For End-Users: Check your installed extensions in Microsoft Edge (edge://extensions) for any Manifest V2 warnings. Begin identifying Manifest V3 alternatives for essential extensions.
• For IT Administrators: Audit your organization’s deployed Edge extensions to identify all Manifest V2 instances. Plan and execute the migration to Manifest V3 replacements. Update Group Policies (ExtensionInstallForcelist, ExtensionInstallAllowlist) accordingly.
• For Developers: Migrate all existing Manifest V2 extensions to Manifest V3 as soon as possible. Ensure new extensions are built exclusively on Manifest V3.
• For Organizations: Communicate the upcoming changes to employees and provide guidance on alternative extensions. Prepare helpdesk and support staff for potential user issues related to disabled extensions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.