Here's the thing, though. They work. It's far easier for a low to mid-tier bundleware company to build a basic browser extension that inserts ads or takes ove

Here's the thing, though. They work. It's far easier for a low to mid-tier bundleware company to build a basic browser extension that inserts ads or takes over the homepage/search engine using basic off-the-shelf components than it is for them to install a system-level networking component that intercepts and changes browser networking calls without breaking things. Google Chrome took a dual pronged approach to disallow all extensions except those in their online store an disallow third party changes to browser settings. So, bundleware can't easily install into Chrome. It can easily install into Firefox because you or anyone else on the PC can install whatever you want. Just because this practice doesn't apply to or benefit you doesn't mean it doesn't apply to and benefit the majority of browser users. Remember, the majority of Firefox users don't even use extensions at all. Closing this hole would increase their security browser-wise. Ironic Note: Google Chrome, while attempting to block bundleware from interfering with its own operation, is one of the most widely distributed bundleware apps. Installers that use dark patterns (tricking users to not notice they're installing a new default browser) from Oracle's Java to Adobe Flash to Avast to Antivir all are used to install Chrome onto systems (hopefully) without the user noticing.