Most bad extensions I've come across when trying to vet what I'm installing fall into two categories: those that are passively malicious: inserting redirections

Most bad extensions I've come across when trying to vet what I'm installing fall into two categories: those that are passively malicious: inserting redirections to affiliate links (or sometimes randomly spawning ad), and those that are "actively malicious" by scanning for browsing history and then sending that over to be sold off. I guess the general idea of manifest v3 is to limit the page/extension boundary to being declarative in nature. I haven't looked into this too much to know how restrictive it is in practice, but at least one such thing is that webRequest is neutered so extensions can't run their own logic for request pre/post processing (where they might try to obfuscate/disguise the target redirect), instead they have to declare the list of redirect targets upfront, where presumably they can be scanned by trivial static analysis. While I think there is indeed a problem of malicious extensions, I don't believe that manifest v3 is the solution. Switch to a more granular but still non-declarative permission model might be useful to gain a stronger signal on malicious extensions, or maybe requiring web store extensions to be declarative but allowing "power-users" to still manually install non-declarative extensions.