Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job.
https://docs.google.com/document/d/1wtV5rmLhbf1OZkbg7crtCt6h...
Firefox and Safari do exactly that.
> The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job.
Does that work? I've never seen any pages that circumvent alert blocking like that, and I'd have imagined that any sensible implementation would disable alerts for the entire session (or at least a few minutes).
Truthfully, I have not actually observed this behavior on Firefox, and I'm quite thankfully no longer in the business of providing technical support to personal computer users, so hopefully I never will.
In theory some very recent barely used newer Android version fixes this by asking for permissions at first use of them (eg first time using camera or first time accessing contacts). In practise this doesn't matter for several years.
That kind of proves the walled garden is pretty ineffective, the only accomplishment being the lock-in of users to Google's Web Store as the sole distribution mechanism, thus keeping Chrome a proprietary platform, in spite of the open-source nature of its code.
The only real advantage of the web store is the ability to uninstall banned extensions. But that could have been accomplished just as well by digital signing of the distributed packages.
This does seem like a total mess.
I even tried to put my extension up on the Web Store just because of this but I gave up once my (obviously valid) credit card got rejected. Now I just live with it.
I've reported malicious extensions and a year later they're still there racking up installs.
That may be true for "always-running" extensions like ad blockers, but there's another useful class of "on-demand" extensions that don't need full access -- think Evernote or Pinboard clippers. They only need access to the one site you're looking at, and only when you invoke them.
Chrome added a tightly-scoped "activeTab" permission a few years back, for exactly this case. Before that, on-demand extensions did need all-sites access, and unfortunately a lot of extensions (and tutorials and example code) haven't been updated.
Extensions make it even easier to install them, though, just need to redirect a user.
I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX extension".
The only remedy is good screening in the app stores. Actually, for apps/extensions installed from the official repository, I would be OK with remote removal. This would probably spark an outcry from certain parties, but as long as it does not extend to manually installed extensions it's acceptable to me.