Now that modern operating systems come bundled with antivirus and complicated kernel security techniques and most-of-all, because the Web is winning and most of our computer interaction is through a web browser, browser extensions are a prime place for malware to enter someone's PC. Both Mozilla and Google have not given it enough attention. It's good to see this taking place. I can understand the concerns about walled gardens and so on, but I think that's just a pill that you have to swallow. If you want to use a self-loaded extension, that's still available and you'll always be able to find a chromium build that does that if it's very important to you. For most people, it's not a big concern.

All that being said, there's still so much that Chrome needs to fix when it comes to extensions. Extension updates are done in a very opaque way. Extensions that alter network requests have precedence based on their install order --- and there's no clean way for two extensions to really coordinate between each other. This means that HTTPS Everywhere and Decentraleyes and uBlock conflict with one another, and the solution might be to uninstall and reinstall them in a different order. That is clearly insanity. What happens when you login to Chrome on a new machine and your extensions are pulled in, is the install order guaranteed to match your previous machine?

There's also no centralized storage for extensions, which means that settings are generally going to be completely different between machines unless the extension implements its own syncing/backup code.

There's also no way to disable an extension on one machine without disabling it on another machine. That means that if you want an app on your Chromebook, it's gotta be on your desktop as well.

It's frustrating to use extensions on Chrome.