Things have gotten bad enough that I've stopped using extensions that haven't been through a code vetting process.
> Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status.
Mozilla's review process is much more strict than Chrome's: they required me to produce original source code for all libraries that I am using (like jquery), forced me to get rid of some leftover eval's in javascript, etc. I don't think they read all source code, but they definitely look for some patterns.
If by recommended you mean "featured" flag on Chrome webstore then I believe that happens automatically if the extension satisfies their "best practices" criteria.
What does that mean in reality? Pretty sure Chrome Web Store extensions are reviewed, but since they're all minified and obfuscated garbage, I wonder how easily malicious code could slip through. I'm surprised there hasn't been a mass cookie stealing attack yet.
CWS doesn't review every extension submission, at best they do some % of them along with anything that sets off red flags. Out of hundreds of times I pushed updates to my extension (~100k monthly users by the end) it was delayed for human review maybe... twice?
maybe its time for a LLM based security review open source framework. this could be adapted for extensions to see what information they'd be sending over.
It means taking malware seriously, even if that means you have to pay human beings to vet code manually. I realize that Google wants to avoid paying human beings at all costs, but too bad.
> Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status.
https://support.mozilla.org/en-US/kb/recommended-extensions-...
If your browser doesn't have a code vetting process for extensions, I'm not interested in your browser.