> I don’t want extensions (attack vector)

How do you block ads and invasive trackers? DNS only?