> if someone owns the chrome auto-update system then they can run arbitrary code on everybody's machine It would be easier to compromise a large browser plugin

> if someone owns the chrome auto-update system then they can run arbitrary code on everybody's machine It would be easier to compromise a large browser plugin's source control. If say, AdBlock was compromised, that's tens of millions of users that would be running malicious code with absolutely no indication that the update even occurred. With DOM level access on every page a user browses to, an attacker could just compromise passwords, inject their own advertising, attempt to gain higher access, etcetera. For the case of the OP, that would mean that the client side encryption would be rendered worthless.