To mitigate the problem, Chrome does have the permissions model to limit what extensions can do, and if an extension requires more permissions after an update, Chrome will give you a warning, along with an option to remove the extension. Your best defence is to not grant overly broad permissions when you first install the extension.
Regarding your comment about Chrome's automatic updates being "bad", I disagree wholeheartedly - the web platform would not be able to move forward at the same rate that it can today. One of the biggest problems with IE was simply that it was updated so infrequently that it was really hard to support the large percentage of outdated versions. We'd be in the same situation with Chrome if it didn't auto-update. Furthermore, I trust Chrome to make good decisions for my security. I'd rather have my browser updated quickly so that vulnerabilities in the browser can be fixed quickly before they affect me.
Don't agree with that. As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I'd rather have a few people angry at me than deal with another IE update-style browser that just gets lost out there with nearly zero hope of updating.
For example, I applauded Mozilla for this[1] move.
1. http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitt...
>>"We don't think self-selection will ultimately get us to the place we need to be," he said. "We will force 3.6 on 3.5 stragglers not choosing to update to Firefox 4 or 3.6 (give them the stick). We feel comfortable making the major update choice for users because a) the versions are very similar and b) we'd rather lose a small amount of miffed users than leave a large amount of users vulnerable."
Keeping an old browser version is something I wish a user could not do unless they went out of their way to install a nightly by themselves and that nightly should nag them to death after 15 days to stop using it. The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser.
This sort of attitude really, really disgusts me, as an end-user (and webpage-writer). Many of the things that are being pushed on us, many of us do not need nor want. We want stability, not constant change. Breaking things that used to work is one of the worst things to do. Requiring users to use (and in many cases relearn) newer, more resource-consuming software just creates waste, in the physical and chronological sense.
The idea that you have an environment that relies on an out-dated browser really, really disgusts me! :)
What if instead of actually fixing the real problem, everyone decides to just freeze on whatever version of a browser fits their needs at a specific moment? Fragmentation happens... and that's bad for everyone. I rather have people like you upset at me for forcefully upgrading your system than dealing with all the support tickets of "My IE6 and Firefox 3.5 show a blank page during checkout". There are major advances happening in webdevelopment and they'd move even faster if webdevs didn't have to worry about people who refuse to let go of some old browser.
If it's an old version of TurboTax, fine. That's your thing. It only effects you. But the percentage of different browsers out there has an effect on everyone. It's like the way I was holding on to an out-dated at&t SIM card. They mailed me 4 new SIM cards but I refused to upgrade. Eventually, they just cut my service and I had to go into the shop to upgrade. When they're trying to support all the cellphones out there and upgrading the infrastructure, they can't have people dragging their feet with old SIMs they need to support. There is a very real cost to supporting old SIM cards that don't fit into the infrastructure they're trying to build out for new phones & SIMs. There is real cost in supporting old web-browsers when technology in web-development is moving ahead in leaps.
I stand by what I said; if you think you've solved an issue by staying on an old browser version, you've made a mistake somewhere upstream that needs to be fixed there. If you truly can't move forward for some reason - go download some developer/nightly branch and install that. I'd want that branch to update itself to production path every month though because holding an old browser version is not a valid solution. It's just delaying the fix to whatever is really wrong in your environment.
The point is precisely that we don't want you to "move even faster", because it more often than not means breaking things that used to work perfectly fine for the end-user, and the only people who are really benefitting from these changes are the ones getting paid to "fix" things that weren't really broken in the first place - i.e. the "web developers", of whom there are far fewer than end-users (or just people who want to share their knowledge with the world and write a few HTML pages)!
I hope someone starts force-updating your terminal and editor/IDE, introducing all sorts of random changes. Maybe then you would understand why it is bad to make your users' lives worse to make your own life marginally easier.
More seriously, I have a software setup that I have configured to be secure and useful. Switching to a newer version of $whatever might help or hurt in either category, but it's a change I want to make deliberately. I don't see why changes preferred by $randomBrowserVendor or $adCompany will automatically be in my interest.
I disagree with the sentiment that somehow using new features is obligatory and directly related with how much "better" a website is; in fact the most informative and most visited sites I use, are also the ones that tend to be the oldest and not use any of these new features- often hand-written HTML4 or even 3.2.
You've got to be joking? Even if it's true that you mostly use websites that don't make use of new features, then you are extremely unrepresentative. Anyway, even simple content-driven sites like Wikipedia make use of a lot of HTML5 stuff now in ways that aren't necessarily obvious to users. And although much of that stuff could theoretically be made to work in older browsers, it's not viable to do that because it would be prohibitively expensive to maintain. So not as much good stuff could get built. That's how end users benefit.
But the real problem is this:
> in fact the most informative and most visited sites I use
You are mistaking yourself for the majority. Therefore, the reality is, none of the above will be "better" as defined by you. However, if what you are saying is true, then any site of yours using HTML 3.2 would be a better site as a result of using HTML5, as it's more semantic in nature, and as a result, provides better support for providing usability and accessibility.
You are free to disagree, of course, but you'd be wrong because your reasons are not 'better' than mine.