Any updates like these are appreciated since I've all but stopped using extensions, and would like starting using them again one day. I don't think the current

Any updates like these are appreciated since I've all but stopped using extensions, and would like starting using them again one day. I don't think the current system with messages in the UI like "read/change all data on all sites you visit" is acceptable in the current 2018 environment. I feel like a default-deny-all policy and a (user friendly) way to review what data/urls an extension is accessing is needed. There currently is too much trust involved, and it seems like it shouldn't be needed. One idea is for chrome to provide the extension with a sandboxed, virtual dom api that doesn't pass any user identifiable data. The extension registers with chrome the functionality it provides, like "fill the main password field with this string", and chrome executes that action internally. It can never request user/history/etc data, just provide functionality to a black box.