As has been discussed in this answer, a flaw with the Chrome Web Store is that an honest-but-naive developer may sell a popular browser extension to someone like Techno SoLotions, assuming that Techno SoLotions wants to continue developing the extension, only to discover later that the new "developer" actually just wanted to turn the extension into adware or malware. The current users of the extension receive an update that helpfully introduces extra ads into every page you visit, while maybe introducing a few security exploits.
In other words, it's not enough that the developer and extension are trustworthy now. For an extension to be "safe", you have to somehow determine if future versions of the extension will also be safe.
The real solution may be for Google to take more responsibility for its "store", but what can a user do? All I can think of is:
- Don't install extensions at all - Seems impractical, along the lines of "never install any software"
- Don't allow extensions to install updates - would this be a security risk in itself?
- Only install updates from developers who (in addition to being trustworthy) have committed to never sell their extension - I have never seen such a commitment myself
- Carefully review changes when an extension asks for new permissions - This only works for extensions that can't already "read and change your data on any website you visit" already
Is there a better way to be reasonably sure that my extensions will stay faithful? Or is it time to say goodbye now while we're still friends? I just don't want to get hurt again...