37k Chrome users downloaded a fake Adblock Plus extension

I don't think, Google has any interest in doing that. You can't either block internet access on a per-app basis on Android, even though this would close tons of information leaks, that the clunky permission system they currently have in place just can't fix.

And as for the best thing to do from Google's side, that would probably be what Mozilla is doing. Sit actual human beings down to look at the code of newly submitted extensions and of extension updates.

No, this does not scale, can't be automated by some algorithm, but it actually works. And it's not like it needs to scale into the millions.

uBlock Origin was originally just uBlock, but a rough moderator took it over (or that's somewhat the story) so there's the Origin fork with the original Dev, the uBlock project does not appear to progress anymore.

1. Minimize the amount of extensions you use to the bare essentials. If you can live without it, uninstall it. If you rarely use it, uninstall it.

2. Prefer extensions from well-known organizations rather than unknown individuals. Example: there are plenty of extensions that force HTTP requests to HTTPS when possible, but I exclusively use the one from the EFF. Organizations have less to gain and more to lose from breaching the trust of their users in this way.

3. Prefer extensions that multiple software developers have recommended personally. This won't itself protect you from malware, but it does increase the likelihood that emergent malware will be discovered promptly and loudly publicized.

4. If you absolutely need an extension and none of the above apply, download the source code of the extension yourself and manually load it into your browser, to keep it from being automatically updated. (Part of me is wary to recommend this, as software that never gets updated is historically prone to being exploited by lingering unpatched flaws, but I'm having a hard time coming up with an attack vector of this sort for browser extensions.)

1. Unexpected URL's or IP addresses. Most attack vectors, for example a key-logger, need to call home at some point. Keep in mind, the address may be stored in pieces that are later concatenated together, or other tricks like using charAt() that will break a naive search for "http://".

2. Blobs of base64 code or other obfuscated text that are later eval'd...

3. Or really anything in an eval function is super suspicious.

4. Remote scripts that injected into pages. Does this have plugin have a solid reason to do that? Otherwise, it's an obvious backdoor even if not necessarily nefarious.

5. Look for code that targets specific domains that are out of scope. If you're looking at an extension for a color picker, you wouldn't expect to see code targeting specific high-value sites like Paypal or Gmail.

6. If it's an email productivity add-on, is it stealing emails and contact information from signatures? It's surprisingly common.

7. Some extensions will try to swap out the advertiser IDs or change affiliate links. Unless it's an adblocker, you shouldn't expect to see any code targeting ads.