
How the most popular Chrome extensions affect browser performance - feross
https://www.debugbear.com/blog/2020-chrome-extension-performance-report
======
gorhill
An note regarding the memory usage in Chromium and uBO specifically.

I have observed that even though the memory usage as reported by developer
tools under "JavaScript VM instance" stay rather stable in uBO[1] even after a
lot of memory churning operations[2], the figure reported in Chromium's Task
Manager keeps climbing up after each of these memory churning operation, and
forcing garbage collection does not bring the reported usage down in the Task
Manager.

There is something happening in Chromium's extension process (and outside the
JavaScript VM in which the extension run) which may cause wildly various
memory figures for even the same extension depending on how much memory-
churning operations have occurred -- I wish Chromium devs would provide
technical insights about this.

* * *

[1] Around 8 MB when using default settings/lists.

[2] For instance, repeatedly purging all filter lists and forcing an update.

~~~
lifeisgood99
I just want to say thank you so much for uBO

------
crazygringo
Utterly fascinating article.

The main takeaways seem to be that 1) extensions in general wind up
_massively_ increasing CPU time (by 5-20x) when loading "example.com", and 2)
ad blockers wind up _massively_ reducing CPU time (by 4-20x) when loading a
"WCPO news article".

Which makes me happy that I use uBlock (edit: Origin, thanks below), and sad
that I have to use LastPass.

 _HOWEVER_ \-- I feel like both these metrics are potentially highly
misleading, because CPU time isn't something the user directly observes -- it
might be the limiting factor, or it might not affect the user experience at
all (because the CPU usage is happening while waiting for further network
resources that are even slower, or the CPU usage is happening after the page
has visually finished loading all relevant content).

I'd be much more interested to see how extensions like Evernote or LastPass
increase the time it takes for a real webpage (e.g. "nytimes.com") to _finish
painting the viewport_ not including ads, and similarly whether adblocking
actually decreases the same -- or if all the advertising stuff really only
happens afterwards. (Because sites are architected differently, you'd need to
compute an aggregate score across a range of common sites.)

~~~
sa46
> I have to use LastPass.

I recently switched from LastPass to 1Password because of the added latency
from Lastpass. Lastpass adds about 70ms to first contentful paint on
example.com. 1Password, on the other hand, runs after the painting is done so
it doesn't block rendering. I polished up a blog draft I had lying around
about switching to 1Password: [https://joe.schafer.dev/passing-
lastpass/](https://joe.schafer.dev/passing-lastpass/)

> I'd be much more interested to see how extensions like Evernote or LastPass
> increase the time it takes for a real webpage (e.g. "nytimes.com") to finish
> painting the viewport not including ads.

I reinstalled Lastpass to test on nytimes.com. It takes 58ms to evaluate
onloadwff.js (the Lastpass entry point) before any content is rendered.

~~~
DaiPlusPlus
I have LastPass, but I keep it in “only activate extension when I click on the
toolbar button”.

The only annoying thing is that LastPass requires the whole page to reload
first - I don’t know why Chrome can’t load an extension into an already-loaded
page.

------
a_imho
_Most ad blockers work by blocking certain network requests that are initiated
by the page. DDG Privacy Essentials reduces the number of network requests by
95% and the download weight by 80%._

 _DuckDuckGo Privacy Essentials reduces the CPU time of the article page from
31s to just 1.6s. All other tested extensions also bring CPU time down to at
most 10s._

It seems the single most important thing regarding Real Word Performance is a
good content blocking functionality (not to mention other boons). Why don't
browsers come with one by default?

~~~
c17r
Because the most popular browser is made by a company that makes the vast
majority of their money from ads.

~~~
pjmlp
And to large extent, the same developers that complain about ads are the ones
to blame that Chrome has reached that market leadership.

------
pirsquare
Great research! I'm a user of evernote web clipper and seeing that they're
adding 3mb to every page that I'm using is extremely discouraging. My browse
to clip ratio is around 1000:1 and I'm probably removing the extension after
this.

Just wondering, can browser extensions codesplit their bundles? If it's
possible, then it is really disappointing to see these large companies loading
huge bundles on initial load.

~~~
Lex-2008
Did you try to set the extension to "run on click"? Right-click extension
icon, "This can read and change site data" -> "When you click the extension".
I didn't try it myself (it might require reloading the page), but might be an
option for 1000:1 browse to clip ratio.

~~~
pirsquare
Awesome - Didn't know about this trick. I'm reconfiguring most of the my
extensions to this.

Gracias!

------
the_duke
This is a worthy research topic.

On mobile, with slower networks and much worse CPUs, uBlock often completely
changes the experience. (thanks Mozilla!)

I would note though that only example.com was examined (and apple.com in one
test).

I also did not see information if tests were repeated, as no variance/stddev
is given. I'd expect it to be pretty high.

~~~
darkport
How are you installing Firefox extensions in mobile? Is it Android only?

~~~
panpanna
Firefox for Android is (at least for my usage) pretty much desktop Firefox
with a touch-friendly UI.

Firefox for iOS is not really Firefox.

~~~
WrtCdEvrydy
All webbrowsers on iOS are basically safari reskinned.

------
esperent
Not at all surprising that the worst two extensions by a long way are both
from Avira.

Yesterday I opened Chrome and received a warning that the Avira extension had
been installed.

I certainly did not install it willingly. I'm pretty sure I didn't install any
other software that sneakily bundled it recently, either - I mean, I'm 99.9%
sure that I haven't installed _any_ software in the past week. So how why did
it suddenly show up? I reported it to Chrome from the web extensions store.
Highly unlikely that they'll do anything about it though.

~~~
sp0rk
> So how why did it suddenly show up?

If Avira has a pay-per-install program, I would say it's pretty likely that
you're part of a botnet.

~~~
esperent
Interesting.

I ran every kind of virus test I could find about a month ago since I was
getting weird display/jank issues. Couldn't find anything, and in the end I
tracked the issues down to a windows display scaling error.

Any idea how I would go about testing for a botnet?

~~~
arprocter
I've seen resetting Chrome fix all sorts of weirdness:

[https://support.google.com/chrome/answer/3296214?hl=en](https://support.google.com/chrome/answer/3296214?hl=en)

~~~
eyegor
Resetting chrome isn't much of a solution if the underlying problem is botnet
affiliation (trojan, rootkit, etc). Should be reasonably easy to shut down all
applications and services, and inspect the traffic going through the router
for suspicious domains. If you only have a windows machine connected there
should only be Microsoft traffic and maybe the router manufacturer. Anything
else, and it's probably malicious.

~~~
lordlimecat
Inspecting your PC's traffic from a sniffer on your PC to find a rootkit seems
like a fool's errand.

If something has driver / kernel level privileges it can trivially hide such
traffic from any sniffer you have running.

~~~
eyegor
Yes, that's why I said to inspect the router's traffic

------
glangdale
It's entertaining that there is yet another area where "running large numbers
of regular expressions, known in advance and not changing all that often" over
lots of input is performance critical.

This was a key driver behind writing Hyperscan
([https://github.com/intel/hyperscan](https://github.com/intel/hyperscan))
which I used to work on when it was primarily used for network security
(thousands or tens of thousands of regular expression rules for firewalls),
but doing this for ad blocking seems pretty sensible too.

~~~
pythux
This is indeed a performance critical problem, but it is already pretty much
solved at this point. If you look at the performance of the most popular
content blockers, their decision time is already below fractions of
milliseconds. So it does not seem like performance is really an issue anymore.

~~~
glangdale
Yeah, I don't doubt that it's solvable by other means (notably hashing). It's
just amusing that something we started building in 2006 - and open sourced in
2015 - largely solves a problem _directly_ (i.e. you don't specifically have
to rewrite your regexes).

~~~
pythux
To be fair, blocklists are not really lists of regexps. They contain some
regexps indeed but the syntax is mostly custom and matching relies on both
patterns found in URLs (This part could be partially expressed as RegExps) as
well as a multitude of other things like constraints on domain of the frame,
domain of the request, type of network request, etc.

------
londons_explore
All the tests were done on an n2-standard-2 gcp instance... That doesn't have
a GPU. Rendering a webpage without a GPU uses a lot of different codepaths and
isn't awfully representative of performance with a GPU.

~~~
mostlystatic
I ran most of the tests on example.com, which is easy to render without having
a GPU available.

Looking at on-page CPU time for Evernote, 91% is spent just processing
JavaScript or HTML. So I expect any benefit of a GPU to be minimal.

~~~
londons_explore
But there might also be a performance _hit_ with a GPU... There are various
antipatterns like drawing on a canvas and then reading back the pixels
repeatedly that perform atrociously with a GPU (due to the latency between the
CPU and GPU). Some sites do a lot of that for things like custom font
rendering, fingerprinting user hardware, custom data decompression algorithms
that use canvas, etc.

~~~
hoten
Lab analysis is always going to have compromises. What's important is the
relative change (without and with the extensions), and that the extra work
isn't especially slowed down because of lack of GPU.

------
erikrothoff
Cool to see our extension tested (an RSS reader). What's great with this is
that it gives us a metric to work towards improving. I've always been under
the assumption that "cpu is cheap", but it does have real effects.

------
helltone
If the author is here, can I suggest testing the Dark Reader extension too?

~~~
mostlystatic
Here are the test results for Dark Reader: [https://www.debugbear.com/chrome-
extension-performance-looku...](https://www.debugbear.com/chrome-extension-
performance-lookup?search=dark%20reader)

I also briefly mention it in the section on FCP, explaining why it makes sense
for the extension to use render-blocking content scripts.
[https://www.debugbear.com/blog/2020-chrome-extension-
perform...](https://www.debugbear.com/blog/2020-chrome-extension-performance-
report#page-rendering-delays)

------
thomasahle
> The Avira Browser Safety extension contains a website allowlist with 30k+
> regular expressions. When the user navigates to a new page Avira checks if
> the page URL is in that allowlist

I wonder who thought that would be a good idea... Sounds like something that
could be significantly improved by compiling all patterns into a single
statemachine.

~~~
aasasd
Yeah, back when I was doing similar matching on a big bunch of regexes, it was
vastly faster to match on all of them lumped together in a group with the ‘or’
operator. And I learned of this more than fifteen years ago from a server-side
lib that deduced the exact browser from the user-agent: it had a huge regex
with various placeholders and a long list of ‘if/elseif’ checks to extract the
values.

~~~
thomasahle
Exactly. If your regex engine compiles to a DFA, you can have arbitrary many
or clauses with no overhead. It's pretty neat.

------
traspler
It seems like the included pw managers like LastPass & Dashlane also impact
page loading drastically. Is there even an alternative with less impact?

~~~
edsimpson
Anecdotally, I noticed a browsing speed up when I switched from LastPass to
Bitwarden on older laptops.

------
lmkg
It looks like a lot of the slowness from the slow extensions is from parsing
and executing JavaScript. Are there opportunities from the browser side to
make extensions faster? It seems like re-parsing the same JS on every pageload
is an opportunity for gains from caching, but I'm also wondering about
different delivery mechanisms like wasm. Are there security considerations
here?

~~~
aasasd
Alternatively, heavy code could be kept in the background script while page-
injected scripts only do interaction. This would even employ the JIT properly.

------
SeanDav
> _" DDG Privacy Essentials does a simple object property lookup based on the
> request domain, an operation that is practically instantaneous"_

This sounds interesting. A bit of searching is not providing much
enlightenment - anyone care to explain in a bit more detail?

Also, if it is so fast, why aren't all the filter add-ons doing it?

~~~
gorhill
Content blockers in the same class as uBlock Origin ("uBO")[1] have the added
burden of having to enforce generic filters which are independent of the
request domains, they have to find a specific pattern in the request URL,
including with support for wildcards.

Even though, and despite this added burden, I will point out that uBO is
almost as performant as DDG Privacy Essentials as per this report.

Furthermore, uBO contains WASM modules but they are not used in the Chromium
version of the extension since this would require to add a `wasm-eval`
directive to uBO's extension manifest, something I prefer to avoid for the
time being, I fear this would cause more lengthy validation of the extension
by the Chrome Web Store.

* * *

[1] Able to enforce EasyList, EasyPrivacy et al.

------
salmo
I would be curious to see this for Firefox extensions as well.

------
k__
I like Grammarly, but the extension is really crappy.

~~~
bvm
Grammarly causes a surprising amount of frontend issues.

------
ChikkaChiChi
Has a browser team ever considered the possibility of creating allowlists for
extensions only on certain websites? A native implementation of something like
uMatrix that also worked on extensions could help end users at least remove
slowdowns on sites they need to be performant.

------
iou
Nice article. This seems like a relevant contrast to share here
[https://brave.com/improved-ad-blocker-
performance/](https://brave.com/improved-ad-blocker-performance/)

------
goalieca
I typically run a number of extensions:

duckduckgo privacy essentials, ublock origin, privacy badger, and whatever
built-in firefox has.

Perhaps this is overkill but they all cover slightly different things.

------
WhompingWindows
Can someone give me an ELI5 on Privacy Badger? My current stack is just uBlock
Origin, I'm considering layering PB over the top.

~~~
identity0
In my experience, PB pretty much does nothing. UBO already blocks trackers and
social media buttons, and if it doesn’t, you can turn on those filters. PB
doesn’t even block the trackers until it “learns” that they are trackers, it
just avoids sending cookies (which doesn’t stop facebook from fingerprinting
you.) The best method would probably turning off 3rd party scripts and iframes
in UBO, but that does mean you have to un-break a lot of sites. An extension
like cookie autodelete would also do much more than PB, since, if you have no
cookies, they can’t be sent.

Edit: I realized that I sound like I’m bashing PB too much. PB is definitely
better than nothing, and doesn’t break any sites, but there are better things
you can do which make PB obsolete.

------
PaywallBuster
I've seen ublock causing CPU to be pegged at 100% making various js heavy
applications completely unusable.

[https://github.com/uBlock-LLC/uBlock/issues/1829](https://github.com/uBlock-
LLC/uBlock/issues/1829)

~~~
smichel17
For anyone glancing by: Note that this is uBlock, not uBlock origin.

------
sizzle
Am I creating a bottleneck by running Ghostery with uBlock Origin?

------
user2233
hello

------
baggy_trough
Don't ever install extensions. There is no limit to the trouble and pain they
can cause.

~~~
saagarjha
Never browse the web. There is no limit to the trouble and pain it can cause.

------
visarga
Cool, but it doesn't matter that no-extension is much faster because we can't
browse without ad blocking. Even if it slows the page, it is still preferable.
On the other hand ad blocking wastes less bandwidth and memory.

~~~
laurent123456
I don't think you read the graph right. Without ad-blocking extensions, the
browser is of course much slower, about 15 times slower according to their
tests.

~~~
londons_explore
I am doubtful of some of the numbers here... I mean I know browsing the web
without an ad blocker is bad, but it isn't 'takes 35 seconds to load an
article on gigabit ethernet' bad....

~~~
smichel17
That was a graph of cpu time, not network request time, and 20s of the 30s
were spent parsing and running js.

