Keeping track of which extension goes rogue or what eventually breaks if not maintained gets really tiring.
After dealing with this so many times, some strategies have stuck:
0. Prefer extensions that work locally, no data sent out anywhere.
1. Keep an extension audit profile, meant for testing them a bit.
2. Use different extensions for my main daily driver profile, shopping comparison profile, etc.
2. The audit profile also has bookmarks of the extensions I'm using and others for later review, or looking back, helps me declutter the main profile a bit.
3. Use https://chrome-stats.com/ to check the extensions' pedigree, they have a trust meter based on the amount of permissions asked, how long has the developer been around, etc.
4. Do your own review on what goes out with developer tools on requests, especially if the extension needs permission to a control domain. Many will tell you in the Privacy Policy that they don't collect anything PERSONAL, but need to process your data somehow, and from an initial look you can't really tell it's a service or the extension itself doing it. Lack of clear wording is key here.
5. Some mask the control domain using a subdomain of a cloud platform to host the app, so it looks more trustable, and tell they only send telemetry data there.
6. Prefer stuff that's also on github, but don't trust blindly: some developers have just posted a boilerplate hello world there.
Two related anecdotes:
1. The Glarity extension (AI GPT autocomplete stuff) is open source, you can find it on github too, it explicitly said it worked only with your OpenAI API key only, yet when installing it, it just worked and I was getting GPT-powered summaries. They have their own service, where they relay all your input, but there is no documentation of it anywhere. I didn't double check if those requests stopped once you added your own API key. That was months ago, now just checked before posting, still no news from them on that functionality. While I can ascribe this to just general sloppiness, there've been some repos with serious accusations of stolen keys (lencx/nofwl)
2. I've had login data leaked with a shopping extension, where Chrome alerted me and disabled it. That was in 2021. It was pulled from the store. Months later I start getting login notifications in my email to some websites I use with my 'shopping/price compare' profile. They were attempts from Russia. The websites alerted to my email yet let session go through, since I don't use 2fa. It seems they were scanning for some saved credit card or something.