How Manifest v3 forced us to rethink Browser Guard, and why that’s a good thing

Manfest v3 forced Malwarebytes to rethink Browser Guard, shifting from live, deeply custom logic to a system built around Declarative Net Request rules. The article explains that Manifest v3 limits how extensions can run complex logic, meaning Browser Guard now relies on static rule lists rather than on-the-fly analysis. While Chrome supports faster extension updates, other browsers lag, making dynamic rule updates impractical for some users.

In response, the Browser Guard team devised a pattern-matching approach that uses full regex-based URL matching, XPath and querySelector support, and checks across page content, including favicon spoof detection. They emphasise that this enables updates roughly every 30 minutes, rather than waiting for full extension updates, to tackle AI-generated site duplicates and homoglyph tricks.

The piece notes that, for now, some large, on-page logic cannot block subframe requests, so the team is leaning more on pattern-based and heuristic protections to keep users safe. 2 February 2026.