How would the browser detect an extension that gets access to information that should not get out, then mixes it into a unrecognisable (by the automatic analysi

How would the browser detect an extension that gets access to information that should not get out, then mixes it into a unrecognisable (by the automatic analysis) wad of data that is sent to some server, and actually is decodable by some third party? This is bad. This is what Chrome apparently does with X-Client-Data. For reason that I would relate to Godel's theorem I think detection cannot be done automatically. Therefore, any access to private information makes any extension tainted somehow. What about an extension that does not explicitly ask for information? In this post-Meltdown world, private information can be inferred by any program running for a sufficient amount of time. So, any program or extension could be considered tainted. Also, even a "neutral" feature, for example implementing a faster alternative to HTTP, could exfiltrate data in non-obvious ways, if only via playing with timing. TL;DR open-source only, code reviewed software is the only hope in sight , but it is currently weak enough to allow channels mentioned in these threads.