Firefox 127 grants host permissions when installing MV3 extensions

So-called host permissions have generally been optional for Firefox extensions since Manifest v3. Starting with Firefox 127, host permissions are automatically granted when you install the extension.

Browser extension developers use what is called the WebExtension architecture. There is the older version of the standard, the so-called Manifest v2 (MV2), and its further development, Manifest v3 (MV3). Firefox has largely supported Manifest v3 since the release of Firefox 109 in January 2023.

The main difference with MV3 extensions is that host permissions, i.e. permissions that apply to specific domains, are essentially optional and can be deactivated by the user at any time. Add-on developers need to take this into consideration and should also provide an easy way to activate it. Otherwise, users have to grant permissions more difficult via add-on management (about:addons).

For example, this could look like this:

With Firefox 127, Mozilla has one Important change For MV3 extensions: Although host permissions are still automatically granted during installation with MV2, this is no longer the case since MV3. Starting with Firefox 127, host permissions are also automatically granted to MV3 extensions upon installation.

For the reasons mentioned, the recommendation for add-on developers still explicitly states that permissions that are not granted are still taken into account. It should also be taken into account that additional host delegations, which are added with the update, not now It is granted automatically.

This change is a temporary fix until Mozilla can provide an improved installation flow, which will require more time from Mozilla. It also overrides this temporary solution Restrictions, which is currently still available for MV3 extensions on Android. The change affects both Firefox for desktop and Android.

Firefox 127 is currently scheduled to be released on June 11, 2024.