I said potential spyware. Now it looks safe, then an update comes. I'm more referring to the current extension model as insecure in general. Like, why cannot we allow extensions to only access the tabs with select websites open? We can only choose whether or not to allow them to run in "private windows", but when we do, they have unlimited access to all open tabs.

This lack of fine-grained control is begging to be abused, and it's only a matter of time someone does so.

What do I suggest? I suggest to let browsers browse and not run arbitary code, I suggest to return their codebase to some humanly-auditable size and to offload all client-side complexity to standalone applications. Preferably command-line, maybe with some HTTP interface accessible on a local port if noobs are so inclined not to use CLI.

Current 2.5-engine "modern web" oligopoly must die.