We get pwned when Chrome plugin devs sell out. A look at malicious auto updates

Plug-ins and extensions to GUI applications tend to end in tears. If you add enough extensions to your web browser or IDE it will be FUBAR.

The reason?

One reason is that any code that uses CPU and blocks rendering can freeze the app. Browsers avoid this more than anything but at severe cost (asynchronous everything, limited content filtering, …). No individual memory allocation is bad but make enough of them and you have a problem. Malware is a big problem but is down the list.

I tell people to (1) not install extensions, (2) only install a few trusted extensions that save resources (ad blockers, anti tracking)

Installing some extension because it is going to make it ‘easier’ to use a feature on some website is like buying stuff on the dark web and being amazed when you get a visit from the FBI.

Autoupdates are like not locking your door so that the burglar can rob you without breaking in.