Those popups that hijack the back button and pop up an alert when you try to close them are enough to get them calling the phone number they see in the window and pulling out their credit card to "have their computer fixed".
However, the Chrome browser uses a Safe Browsing list which blocks many known malware/phishing sites.
https://www.google.com/transparencyreport/safebrowsing/
The list is constantly being updated, both by automated and manual means.
You can also submit bad sites here:
https://safebrowsing.google.com/safebrowsing/report_badware/... https://safebrowsing.google.com/safebrowsing/report_phish/?h...
If you find one that isn't blocked, I'd definitely encourage you to do your bit and submit it.
Firefox also uses the same Safe Browsing service:
https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
doesn't really help when rogue extensions can still do a lot of harm (ie. log passwords)
To be honest, I've yet to actually see any rogue extensions on the store - have you seen any?
Furthermore, each time you install an extension, you need to explicitly grant it rights to various things. So there's definitely some user attentiveness needed there, just in case.
But if you want to be heavy-handed (and have GSuite and a Chrome management license) - you can actually set it up so they can only install whitelisted Chrome extensions. So you could whitelist all the common ones you think they'd install, and if they want additional ones, they can request them:
https://support.google.com/chrome/a/answer/1375694?hl=en
A lot of corporate/school environments have it setup this way - they whitelist known good ones, and the admin will add more when people request it.
To be honest though, most non-tech savvy parents probably don't need extensions - my mother for one hasn't installed any. The Chrome browser itself covers most of their use-cases.
I got a Dell Chromebook for my mother.
It's nigh on unbreakable, and is great for non-tech parents. Each tab/app runs in its own sandbox, and it allows them to do the things they want (i.e. browsing).
It automatically updates in the background (none of that Windows update rubbish), it has inbuilt malware block lists (via Chrome Safe Browsing), it's fast, doesn't bog down over time etc.
Even if by some magic they brick it, a simple Powerwash (https://support.google.com/chromebook/answer/183084?hl=en) and 5 minutes later, it will be back to a pristine state, they log in with their Google account, and it pulls down their settings again.
Also, if you want to see the latest and greatest coming in ChromeOS - try the Canary channel =). (But be prepared for rough edges).
Feel free to ask any questions.