"Google removed extensions, Microsoft slower to respond"
Typical. Microsoft products just don't have a good record of security. They tend to be overdesigned. Lately, they've been prioritizing layoffs and "AI" spending. Windows has fallen to a very low priority.
However, with extension takeovers, essentially what will happen is the author of the extension, who has undergone verification, will sell the extension off, and then whoever buys it inherits the entire installed base and can modify the extension and use automatic updates to push out a version that does malicious things. It takes advantage of the time between when that happens and when Google notices and removes that extension.
Once most people install an extension they never think about it again and it's just there, even if they don't use it. The more of them you have the higher the odds that this happens to you at some point, so you should only install extensions that you actually use a lot and which are from trusted people with a long record of providing good software.
Mine are ublock-origin lite for ad blocking (the ManifestV3 version), SponsorBlock for YouTube, Video Download Helper, Capital One Shopping, Web Archives, RECAP (adds federal court records to RECAP so other people can view them without paying PACER after I look at them), MediaPlayer (turns Chrome on my Chromebook into a media player for offline files), and Old Reddit Redirect.
Mozilla used to track who installed extensions. They said the majority don't have any, and out of the people who do, it's usually an ad blocker if they have any at all. The average number of extensions among users who had some was only 3 extensions.
So I doubt most people are in serious risk, but if you just go jamming extensions in and never consider what you need, you might be at higher risk.
Also, most extensions don't run in private browsing mode unless you let them, so save private browsing mode for handling things youu don't want to risk having an extension see. The only extension I let run in private mode is ublock-origin lite.
On my Android phone, I don't use Chrome because that one has never had an ad blocker. I have Fennec F-Droid. Which is a de-blobbed version of Firefox. I also have Privacy Browser from F-Droid, which uses a webview from the system, but turns many "features" like javascript off by default. This has a side effect of busting through many paywalls.
Recently, Mozilla made an update to Firefox that got down into LibreWolf. It crashes on my Chromebook now when I run it in Crostini, but Brave, Vivaldi, and GNOME Web do not crash.
I am eagerly awaiting Google fixing the remaining hangups so that I can upgrade the container to Debian 13 "Trixie" which should bring in a much newer set of graphics drivers, and Vulkan support. Hopefully that fixes a lot of the issues I experience with some accelerated graphics.
Thankfully Steam for ChromeOS runs outside the container.
I've never been very patient with computer software that isn't secure or very stable. Out of all of the software I've used, Microsoft's is always the worst. The people who can't figure out Linux seem to prefer Apple I guess.
I just watched The Silence of the Lambs again, and as Hannibal Lecter put it, simplicity.
"Simplicity. Read Marcus Aurelius. Of each particular thing ask: what is it in itself? What is its nature?"
With malicious software, it's usually not trying to just wreck your computer and make it work poorly. That doesn't gain a financial criminal anything. They want to write malware that you won't notice, while it's stealing all your login data or doing ad reinsertion fraud or changing affiliate links or something.
If they make your computer run badly, you might notice and take action.
Most security mechanisms that protect the OS don't do anything against financial fraud malware, because it's not even trying to manipulate the OS. That's not where the money is. So, increasingly you're seeing things that these layers of security don't do much about even if they are working correctly. And the browser extension takeovers are part of that group.
Interestingly, I had an argument with Alan Pope when he worked for Canonical, AKA Ubuntu Linux, they're the company behind that.
I liked their early work, back when Debian Linux was "raw" and "rough" and even Linus Torvalds himself had trouble installing it properly.
Canonical came and developed an Ubuntu live CD where you could boot off of it, check that everything basically worked, see if you liked it, and if you wanted to commit to installing it, there was a self-help program (wizard) that guided you through it, and other than setting a username and password and your time zone, you could basically smack next a bunch of times and get a working system even if you did not understand what you were doing.
But then they went off the deep end and started wasting literally millions of dollars developing the Unity desktop, which is now abandoned from their perspective (community forked), and I said it wouldn't work out for them and I was right, then they developed a "containerized application format" called Snap, and it competes with the better designed, fully open spec, and more universal Flatpak format.
(Note: Universal containerized apps bring Windows concepts to Linux, and not in a good way. They're extremely bloated because they rely on their own shared objects instead of the system's, and they frequently end up with areas of poor integration and bugs because of sandboxing and being walled off from shared resources.)
For a time, Canonical even themselves engaged in "affiliate hijacking" by changing the monetization referral link in Rhythmbox so it would not generate donations for GNOME (which wrote that program), but rather themselves, when you bought MP3s from 7Digital.
I said on Reddit that with Canonical in charge of a "store" and allowing proprietary software in that they did not build themselves, and had no way of verifying, that it wouldn't be long before "Linux malware" which was never much of a thing, to arrive, and it would happen the same way malicious extensions end up in Chrome. You'd end up with apps that were fake and malicious to begin with, or the person would get something innocuous in, and then slip a bitcoin miner or something into it later (which happened), or people would sell their approved app listing to malicious people and you'd get malware that way (also happened).
Today, I have three laptops. One is a Chromebook Plus, blinged out, lots of RAM and fast CPU, it has Debian in Crostini. I also have a 2020 Lenovo that's running Fedora with KDE, and a 2016 Lenovo that's running KDE NEON. NEON is based on the Ubuntu base system. It has Snap, but no Snaps are installed, and they fixed Firefox so it's actually a Debian package.
The reason "app stores" are actually a sewer and "software repositories" provided by the OS tend not to be, is because much more care and caution go into the "software repositories". Most software is open source, so you couldn't slip malicious programs in easily because everyone would see the code and sound the alarm, or even make a new version without the malicious features and recompile and ship that one, and it's been carefully selected and built by the OS vendor themselves, and the packages are digitally signed, so if a malicious person tampers with a mirror, you get an error from your package manager, not a malicious replacement.
Simplicity.
Of any thing, ask what it is in itself, what is its nature?
Does Google or Microsoft care if your computer gets infected with financial fraud software? Not really. They'll remove it eventually if they become aware of it, but it's not hurting their stock price so they don't truly care.
And in many ways, that sort of heavy handedness that you need to have security on a platform like iPhone makes the User Experience objectively constrained and horrible in different ways. It gives the vendor total control, and they will abuse that by banning entire categories of software they do not want you to have, and use it as a buttress of their monopoly, to extract higher rents and drive prices up.
So the two dominant mobile platforms are both convicted monopolists, one is rent-seeking control freak that demands high prices, and the other is an ad company. This situation is....not ideal for the user.
Despite Apple's touted campaign of "privacy", iPhone apps have almost all the same malicious trackers and adware and spyware that Android apps do. There are certain fences around some of it, but for the most part the bad stuff Android apps can do, so can iPhone apps. And what's worse is a lot of these fences at Apple start reeking of "alert fatigue" like Windows Vista's infamous "Cancel or Allow" pop-ups that Apple themselves made fun of in 2007.
In the open source community, we tend to watch out for each other, so malware and financial fraud doesn't tend to go far in a thing like Debian Linux or most distributions for that matter.
Also, Alan Pope later left Canonical during downsizing. Once he was no longer paid by them he recommended removing Snaps and even wrote a small utility that would uninstall all of them for you.
When I was 14 years old, I started developing privacy software.
I contributed to one of the first real "ad blockers" that set up a local "proxy server" between the browser and the networking stack, and it would simply recognize and strip out requests to ad servers based on blacklisting of domains/subdomains. Back then it worked well enough, today they're trickier.
I also wrote some programs to deal with very early adware on Microsoft Windows, either by removing it entirely or replacing the dll's with dummy stand-ins. The program you were trying to use would load the stand-in and figure the adware was working when it wasn't. That became particularly handy with PKZip for Windows.
But as time went on the bad guys got a lot more sophisticated, and I lost interest trying to solve an unsolveable (on Windows, anyway), problem of an increasing amount of malware.
