A good middle ground might be to review only the top 1000 extensions or so and put a trusted checkmark on them. Reflecting back on the automated extension revi

A good middle ground might be to review only the top 1000 extensions or so and put a trusted checkmark on them. Reflecting back on the automated extension review, I just realized that the problem is more complex that it seems at first glance since extensions can also contain content scripts that inject JS directly into pages themselves, so it's easy to mask the source of a POST by injecting the xhr directly into the webpage.