Surely the problem isn’t making changes to a page, but instead having access to the full page content and being able to send it somewhere else.
For example, iOS runs content filters in a special isolated process with no persistence or access to the outside world.
With this model, the content filter requests elements to be removed and the browser does the actual removal. As such, the scope of modifications can be reduced whilst keeping arbitrary and perhaps complex filtering logic.
The implied attack was the content filter changing the page to submit the data it wants snooped. Consider replacing ads with cats from a site the attacker conveniently happens to host, and leaking the desired data in query arguments.
Yes, this is what I said above: “Surely the problem isn’t making changes to a page, but instead having access to the full page content and being able to send it somewhere else.”
“Send it somewhere else” being the important part.
The interface Chrome went with was a declarative list of filters that Chrome will use to perform the actual filtering, but the declarative interface isn’t great and wasn’t well received.
My point is: there is an interface that is non-declarative and sandboxed, whilst allowing Chrome to perform the actual filtering.
Yeah, but you can't do both, that's the point! If you can directly change the website content, the website itself runs in a sufficiently non-sandboxed environment to allow the data to be sent somewhere else. You can only get around this by making a more limited blocking process (which may not need to be as limited as chrome has gone with, but still, not being able to e.g. substitute in shims for ad networks will reduce the effectiveness of your adblocker. It certainly makes anti-ad-blocking have the significant advantage).
How does this differ from how Manifest v3 declarativeNetRequest is in practice? Not saying they're the same, just wondering of the capabilities between these.
For example, iOS runs content filters in a special isolated process with no persistence or access to the outside world.
With this model, the content filter requests elements to be removed and the browser does the actual removal. As such, the scope of modifications can be reduced whilst keeping arbitrary and perhaps complex filtering logic.