How the most popular Chrome extensions affect browser performance

I just want to say thank you so much for uBO

could you open a bug in https://crbug.com/ and tag the extensions component?

Good point about extension code running while rendering is still blocked by the network. That should prevent any user-facing delay.

I just ran a few quick tests with the Top 50 extensions and an NYT article. The charts are ordered by largest median metric value.

https://gist.github.com/mattzeunert/de3c8aedd2936a34eeb88b62...

The Largest Contentful Paint (LCP) chart suggests an interesting phenomenon. Extensions like Dashlane and Evernote appear to slightly increase when that paint happens. These extensions load a large amount of code, but don't block the initial render.

Grammarly does not seem to push up LCP much. Its JS code runs before the page starts rendering, so maybe it is less likely to compete with other code later on.

Normally running code before the page renders would be bad, but if the page is network-constrained at that point it might soften the impact.

Just to clarify to readers who aren't aware, you should be using uBlock Origin and not uBlock.org: https://en.m.wikipedia.org/wiki/UBlock_Origin

> I have to use LastPass.

I recently switched from LastPass to 1Password because of the added latency from Lastpass. Lastpass adds about 70ms to first contentful paint on example.com. 1Password, on the other hand, runs after the painting is done so it doesn't block rendering. I polished up a blog draft I had lying around about switching to 1Password: https://joe.schafer.dev/passing-lastpass/

> I'd be much more interested to see how extensions like Evernote or LastPass increase the time it takes for a real webpage (e.g. "nytimes.com") to finish painting the viewport not including ads.

I reinstalled Lastpass to test on nytimes.com. It takes 58ms to evaluate onloadwff.js (the Lastpass entry point) before any content is rendered.

I was surprised by the choice of WCPO, which to me is a local news station who owns WCPO.com. Does it mean something else I'm not aware of or are they famous for being slow?

> CPU usage is happening after the page has visually finished loading all relevant content

This can be very noticeable though, leading to sluggishness, stuttering scrolling, slowing down other tasks, increasing fan noise on laptops. uBO in my anecdotal experience may almost make a bigger positive impact in this fashion than simply at the initial render.

In mac, there is sort by energy usage in activity monitor and Chrome always takes the top spot (at least for me).

Because the most popular browser is made by a company that makes the vast majority of their money from ads.

Firefox does. https://support.mozilla.org/en-US/kb/enhanced-tracking-prote...

Aggressive content blockers also tend to break websites. Not big sites like Washington Post for very long, but all sorts of small sites and in confusing ways.

For example, we had to rearchitect part of our site that was talking about marketing and advertising because various ad blockers decide any url pattern with '/advertising/' shouldn't be loaded.

Because a web browser should be fundamentally neutral by default. All content should get rendered the same way, regardless of which server or domain it comes from.

That doesn't preclude the browser from making choices to protect privacy and security, but all sites should be treated equally (as Safari does with its tracking protection, for instance).

Brave Browser is Chrome with that built into it.

Did you try to set the extension to "run on click"? Right-click extension icon, "This can read and change site data" -> "When you click the extension". I didn't try it myself (it might require reloading the page), but might be an option for 1000:1 browse to clip ratio.

Nothing stopping them from doing code splitting. Most extensions just modify the dom to insert script tag(s). So the performance strategies are the same as any other frontend app.

I ran the tests 7 times and then took the median. I'll look into quantifying variance more, but for now here's a boxplot for total on-page CPU time. https://gist.github.com/mattzeunert/de3c8aedd2936a34eeb88b62...

I ran tests on example.com, apple.com, and a WCPO news article (for the ad blocker tests).

The biggest performance issue is that extensions just dump large scripts into pages indiscriminately. Most of the time extensions don't do anything differently based on the content of the page.

I also tested a WCPO news article to see the impact of ad blockers. I picked a local news website specifically because they contain a lot of ads. If a page doesn't have any ads the performance impact of an ad blocker will be slightly negative.

What my tests don't pick up is extensions that only run a certain domains. For example, if you run Honey on a shop they support I expect the CPU consumption to increase a lot more.

I wrote a similar article last year, which tests a few other pages as well: https://www.debugbear.com/blog/measuring-the-performance-imp...

How are you installing Firefox extensions in mobile? Is it Android only?

> So how why did it suddenly show up?

If Avira has a pay-per-install program, I would say it's pretty likely that you're part of a botnet.

This is indeed a performance critical problem, but it is already pretty much solved at this point. If you look at the performance of the most popular content blockers, their decision time is already below fractions of milliseconds. So it does not seem like performance is really an issue anymore.

Hyperscan is still dynamic, and C only. Google or Mozilla could use perfect hashes and ship it. (Google won't). You need a native extension for a fast low memory blocker.

I ran most of the tests on example.com, which is easy to render without having a GPU available.

Looking at on-page CPU time for Evernote, 91% is spent just processing JavaScript or HTML. So I expect any benefit of a GPU to be minimal.

Here are the test results for Dark Reader: https://www.debugbear.com/chrome-extension-performance-looku...

I also briefly mention it in the section on FCP, explaining why it makes sense for the extension to use render-blocking content scripts. https://www.debugbear.com/blog/2020-chrome-extension-perform...

That's what Safari does for its ad blocker plugin API. Also allows for greater privacy since the browser can apply a static list and the plugin never knows what you sites you browsed to. Google is trying to move to enforce the same model but it's limiting in some ways and generated massive uproar.

Yeah, back when I was doing similar matching on a big bunch of regexes, it was vastly faster to match on all of them lumped together in a group with the ‘or’ operator. And I learned of this more than fifteen years ago from a server-side lib that deduced the exact browser from the user-agent: it had a huge regex with various placeholders and a long list of ‘if/elseif’ checks to extract the values.

FYI: content blockers like uBlock Origin or Ghostery use block lists of tens of thousands of rules as well (can be up to 100k depending on lists enabled) and there are ways to make this matching very efficient[1].

[1] https://news.ycombinator.com/item?id=19175003

Anecdotally, I noticed a browsing speed up when I switched from LastPass to Bitwarden on older laptops.

I recently switched to Enpass after LastPass started having major issues in both Firefox and Chrome. I was having to remove and reinstall it at least once per week.

Enpass has been great. The setup with Dropbox sync isn’t as quick but that’s just one per device. It’s very speedy and hasn’t gotten in the way at all.

Isn't that weird - not a programmer but ... surely the only code they need to run on every page load is to add an event handler for forms to check if a login form has been focused? (At which point their add-on runs). What else are they doing?

Browser extensions are usually the attack vector for password managers.

I use the native desktop apps for them, previously LastPass and currently Bitwarden. The UX suffers a bit but you at least you gain some security.

Alternatively, heavy code could be kept in the background script while page-injected scripts only do interaction. This would even employ the JIT properly.

Content blockers in the same class as uBlock Origin ("uBO")[1] have the added burden of having to enforce generic filters which are independent of the request domains, they have to find a specific pattern in the request URL, including with support for wildcards.

Even though, and despite this added burden, I will point out that uBO is almost as performant as DDG Privacy Essentials as per this report.

Furthermore, uBO contains WASM modules but they are not used in the Chromium version of the extension since this would require to add a `wasm-eval` directive to uBO's extension manifest, something I prefer to avoid for the time being, I fear this would cause more lengthy validation of the extension by the Chrome Web Store.

* * *

[1] Able to enforce EasyList, EasyPrivacy et al.

To add to the excellent answer from Gorhill, you might find this read interesting: https://0x65.dev/blog/2019-12-20/not-all-adblockers-are-born...

It is a deep dive into how modern content blockers work and what kind of rules they have to enforce (they are usually much more complex than simple domains, though).

As a side node, I recently ran a small experiment and found out that around 90% or blocking from Easylist/EasyPrivacy/uBO lists can be done based on domain information only. But of course this leaves a lot of corner cases where sites might break or ads might still show, and ultimately more granularity is needed to address these cases.

When you have an array, it's way faster to check the existence of array[key], which is O(1), than to loop over the full array to find if one of the values match the one you're searching for, which is O(n).

This is used in hash tables, for example: https://en.wikipedia.org/wiki/Hash_table

Object properties in JS are mostly the same thing.

I guess other extensions can't do the same because they don't have a simple value to search in a whitelist, but rather a list of regex which must all be executed.

Its open source right? Could you not just look it up https://github.com/duckduckgo

Some filter addons perform complex logic trees based on properties other than the hostname(s) being loaded by the browser, and therefore take up more CPU and RAM for more wall-clock seconds to meet the needs of their increased complexity. They end up able to block more content than others, but that comes at a cost — which, as this page notes, can be much higher than anyone expected.

uBlock Origin doesn't do much worse than DDG Privacy Essentials. A few percent perhaps? I'd say on par with it…

Grammarly causes a surprising amount of frontend issues.

In my experience, PB pretty much does nothing. UBO already blocks trackers and social media buttons, and if it doesn’t, you can turn on those filters. PB doesn’t even block the trackers until it “learns” that they are trackers, it just avoids sending cookies (which doesn’t stop facebook from fingerprinting you.) The best method would probably turning off 3rd party scripts and iframes in UBO, but that does mean you have to un-break a lot of sites. An extension like cookie autodelete would also do much more than PB, since, if you have no cookies, they can’t be sent.

Edit: I realized that I sound like I’m bashing PB too much. PB is definitely better than nothing, and doesn’t break any sites, but there are better things you can do which make PB obsolete.

For anyone glancing by: Note that this is uBlock, not uBlock origin.

uBlock-LLC is not ublock origin.

Never browse the web. There is no limit to the trouble and pain it can cause.

I don't think you read the graph right. Without ad-blocking extensions, the browser is of course much slower, about 15 times slower according to their tests.

> DuckDuckGo Privacy Essentials reduces the CPU time of the article page from 31s to just 1.6s. All other tested extensions also bring CPU time down to at most 10s.

It doesn't even slow down the pages, the opposite is true here.