I don't think it's sleazy, while Mozilla does review all add-ons, it's hard to restrict what an extension right now since they can access internal APIs and ther

I don't think it's sleazy, while Mozilla does review all add-ons, it's hard to restrict what an extension right now since they can access internal APIs and there isn't really a permission system to speak of. Additionally, JS is a dynamic language so it's difficult to provide adequate automated scanning for malicious intent. Even so, extension authors can be quite clever in how they hide malicious behavior, especially if there's financial reward involved. WebExtensions (https://wiki.mozilla.org/WebExtensions https://wiki.mozilla.org/WebExtensions) add a permission system, have a much smaller attack surface, and should help to alleviate this problem. This combined with automated scanning + human review and For Chrome, I think Google prefers a combination of automated scanning and quick response, without upfront human review (based on https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43824.pdf https://static.googleusercontent.com/media/research.google.c...)