Unfortunately since the Firefox team gave up and just adopted WebExtensions wholesale and Edge is dead, the only vendor that's likely to do anything about this is Apple, which means you only get to benefit from a better extension security model on OS X (and maybe iOS, one day).
The idea you describe of tagging data from sensitive sources and limiting its flow is something that's been done in production software here and there, but never to the extent necessary here. It's commonly used to mitigate SQL injection attacks [https://en.wikipedia.org/wiki/Taint_checking]. Part of the problem is that the real issue here is not whether the data is privileged, the issue is whether the use of the data is permitted. If I install the 'Google Translate' extension it wants access to all my tabs, which is technically correct - if I ask it to translate some text in a gmail tab, it's going to need to access that gmail tab. But that doesn't mean I also want it to harvest all my emails and POST them to a server somewhere. You can say "well, disable POST requests", but how are the translation API calls going to hit the remote server?
Naturally gtranslate isn't going to exfiltrate my emails, but if the translation extension was maintained by a smaller vendor, some state-level actor could buy them overnight no problem.
An invasive but effective strategy would be Javascript string/object tagging, where objects and strings derived from identifying API accesses are marked as dirty, and attempting to serialise these into requests or URLs triggers a permissions check. This would also give the option of replacing numbers and strings with junk data if the permission is denied, which seems pretty attractive.
Given the massive scope of a change like this, I don't expect it to happen, but it's nice to think of a world where any website or extension that attempts to exfiltrate data will be noticed by default.
You could only allow GET requests and require the user to whitelist this the first time the extension does it.
Subsequent calls to the same blocklist would go through without a user prompt, but if it suddenly started trying to send your email address or some other param, it would stand out.
Make calls to two seemingly benign requests early on. Now you can send whatever data you want to without triggering another prompt by successively requesting the first resource to indicate a '0' and the second resource to indicate a '1'.
Would this fit what you describe?
* "What the extension can do" is very poorly specified, using language that casual computer users won't understand
* The granularity of permissions is poor so in some cases one operation requires a seemingly unrelated permission. (Android historically has had this problem too)
* While Google have recently made some steps towards improving this specific issue, per-website permissions are something that WebExtensions barely handle. You can technically put a specific list of domain names in your permissions list, but if a site changes domains or adds a new subdomain your extension won't work until you push an update that requests the new permission... and that update will disable the extension for everyone on the planet until they dig around in the UI to find the permission request warning. The last time I checked Google's new solution for this was to allow the end user to narrow the 'access everything' permission to specific websites, which is... something, I guess.
Therefore, any access to private information makes any extension tainted somehow.
What about an extension that does not explicitly ask for information? In this post-Meltdown world, private information can be inferred by any program running for a sufficient amount of time. So, any program or extension could be considered tainted.
Also, even a "neutral" feature, for example implementing a faster alternative to HTTP, could exfiltrate data in non-obvious ways, if only via playing with timing.
TL;DR open-source only, code reviewed software is the only hope in sight , but it is currently weak enough to allow channels mentioned in these threads.
I'm imagining something like a sufficiently advanced type system that could tag data from sensitive sources, and force you to use a different API if you e.g. want to put that kind of tagged information in a network request. Though even if this would be available, I suspect there are many more indirect methods of exfiltrating information e.g. if you have the permission to change page content, which are probably very hard to impossible to distinguish effectively from benign stuff.
Some of the most useful extensions need really scary permissions. I don't see any good way to robustly fix malicious extensions than to create a permissions system that would make the scary permissions unnecessary for most cases.
The current system is broken enough that I try very hard to minimize which extensions I use. It's essentially just an ad blocker and a password safe in my main browser. And then a bunch of dev tools in a different browser I use for development, but not for browsing in general.