Extensions are set to auto update by default, and it's not obvious at first how to disable that. It's also disallowed to install an extension you've built from source on most release builds, without messing with a hex editor. So essentially, any extension you install is liable to be come a "random" extension, if for example, the author sells out, or something like the attacks on NPM were to happen.
reply> Why would someone install "random extensions" that they dont trust.
replySame reason why people download random stuff and run it with administrator permissions on Windows.
> Why would someone install "random extensions" that they dont trust.
replyAn extension that you trust today can be sold to an unscrupulous third-party tomorrow. That has happened many many times and will continue to.
And sometimes the unscrupulous third party decides to build a browser and take over the market via forcing hardware vendors to bundle it with their OS. Like Google.
reply