Browser extensions are the most powerful software nobody audits

You install an ad blocker, a password manager, a dark-mode toggle, maybe a coupon finder. One click, a brief permissions dialog you don't read, and it's running. What you just gave that code is remarkable: full read-write access to every page you visit, the ability to see and modify form fields including passwords and card numbers, access to your browsing history, and in many cases the power to make network requests to any server it wants. And it updates silently — the developer can ship a completely different version tomorrow and your browser installs it without asking.

The review process is thin. Chrome Web Store has 200,000+ extensions and the review team isn't auditing source code line by line. Malicious extensions get caught eventually, usually after they've been installed by thousands of people and a security researcher notices. The pattern repeats: a popular extension gets sold to a new owner who pushes an update that harvests browsing data, or a dependency in the build chain gets compromised, or the developer just decides the data is worth more than the reputation.

The permissions model doesn't help much either. Most useful extensions need "read and change all your data on all websites" because the alternative — per-site permissions — makes the extension barely functional. So you're choosing between "this does nothing useful" and "this can see everything I do online." The middle ground barely exists in the current architecture.

The strange part is the asymmetry. People run antivirus, lock down app permissions on their phone, use a VPN — then install a browser extension from someone they've never heard of that has deeper access to their online life than any of those threats. The browser is where the sensitive stuff happens, and extensions run inside it with the lights off.

Is anyone actually auditing their extensions, or is "it has a million installs and four stars" the whole trust model?