Downgrading Chromium on Debian to get back uBlock Origin
Posted: 2025-04-04 · Last updated: 2025-04-04 · Permalink
With version 135.0.7049.52-1~deb12u1, Chromium on Debian has disabled uBlock Origin, a popular ad-blocker. The background is that Chrome has begun rolling out Manifest V3, a new “version of the extensions platform.” While uBlock Origin offers a variant called “uBlock Origin Lite” that purports to work with Manifest V3, this variant is widely seen as less effective.
This blog post shows you how to get back uBlock Origin (and possibly other extensions) by permanently downgrading Chromium and how to use it more safely with Firejail for sandboxing.
Web browsers are inherently insecure. Using older web browsers is especially insecure.
These instructions will permanently disable any and all updates to Chromium, even security updates.
Your data may be stolen, destroyed or in arbitrary ways compromised by malicious websites or extensions.
There may be other risks known and unknown.
If you follow these instructions, you accept these risks. There is no warranty and no liability if you follow these instructions. You must be sufficiently versed with Debian to proceed, and you must use Firejail.
But even Firejail is not 100% secure. It relies on low-level features of the Linux kernel to sandbox software such as Chromium. Safety and security can never be guaranteed at 100% certainty.
If you are not absolutely sure that you wish and are able to proceed given the various trade-offs involved, you must stop now.
I understand these risks and wish to proceed.
These instructions have been tested on Debian 12 (bookworm) on the amd64 platform. It is unlikely that they work without adjustments on other systems.
- Go to this page and download the following files:
- chromium-common_134.0.6998.117-1~deb12u1_amd64.deb
- chromium-sandbox_134.0.6998.117-1~deb12u1_amd64.deb
- chromium_134.0.6998.117-1~deb12u1_amd64.deb
- On the command line, run sha256sum chromium*amd64.deb and check the output against these hashes:
SHA256 hash File 772c2c34db2b2d9395e251959f476359cf1ff11a1d05ab0eaf894f36e9894f70 chromium-common_134.0.6998.117-1~deb12u1_amd64.deb f1d2d57db2b215a67cb5be7fbdcf3b302ec1fb632d29568b91f175711aec8c1a chromium-sandbox_134.0.6998.117-1~deb12u1_amd64.deb 0621c3b78b6c212fbf19600860b74ee4ad7c0ded95c46279dee141a49862fd74 chromium_134.0.6998.117-1~deb12u1_amd64.deb - If and only if the hashes match, run sudo dpkg -i chromium*amd64.deb to downgrade Chromium-related packages.
- Run sudo apt-mark hold chromium-common chromium-sandbox chromium to prevent apt from updating Chromium-related packages and restoring mandatory Manifest V3.
- Run sudo apt install firejail to install Firejail.
- In the future, always use firejail chromium to start Chromium. Make sure to change any and all shortcuts, e.g. on your desktop. (Firejail creates a separate environment for Chromium to run in.)
This step is especially important and required. Never run Chromium (and especially not the downgraded version) without Firejail. Firejail performs many low-level operations to create a separate environment in which the Chromium-related processes run; most crucially, these processes are not able to see much besides your home directory's Downloads folder.
- You may now run firejail chromium and install uBlock Origin if necessary.
Considerations
- You may undo the above steps at any point by running sudo apt-mark unhold chromium-common chromium-sandbox chromium and then sudo apt update && sudo apt upgrade to return to current versions of Chromium.
- Since Firejail makes Chromium blind to most of your personal folders, there can be issues when starting programs from inside Chromium. As far as I am aware, this is only relevant when it comes to (i) downloaded files that are to be opened from within Chromium and (ii) “apps” that are invoked from within Chromium, such as Zoom. For case (i), open downloaded files manually from outside of the browser. For case (ii), consider just not doing that.
- I like to use several Chromium profiles (for example, to have a separate WhatsApp Web profile). These can be used with Firejail using a simple shell script like the following:
#!/usr/bin/env bash CDIR=$HOME/.config/chromium_profile2 firejail --whitelist="$CDIR" chromium --user-data-dir="$CDIR" "https://max.pm/"
- Firejail works very well with other software, too. I personally use it with Thunderbird, Firefox and Signal.