Using private X in the browser requires trusting the browser, this way you can have the OS isolate processes which has to be stronger.
You'd not want to simplify it too much in it's core, though. That'd exclude advanced configurations outright.
1. Block "(star)" from accessing "(star)://mail.google.com"
2. Install the config
3. Go to chrome://policy/ and click "Reload policies"
4. Open Gmail. Dark Reader doesn't work anymore.
EDIT: It must be me, as I am still not having any luck. I just tested in a slightly older macOS VM (10.12) with Google Chrome 81; even after installing the profile, Dark Reader continues to work on sites that should be excluded.
Here is the generated reg file:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome]
"ExtensionSettings"="{\"*\":{\"runtime_blocked_hosts\":[\"*://ycombinator.com\",\"*://boh.com\"]}}"
It's a pretty useful feature that many people miss.
I've personally just switched from Chrome to Brave. Funnily enough, Chrome was causing my computer to seize all the time while Brave does not, even though it's still built on Chromium. But I took the opportunity to go ahead and clear out a number of extensions. Feels so much better. Your browser can really get cluttered over the years!
I guess that solutions like DNS-level blocking or custom hosts files are a fair balance, but I still like the DOM-based per-element control found within adblock extensions.
And then I see people with like 20 extensions installed...
The easiest way to protect your browser from exploits is to disable or whitelist extensions. At the office we block all but a small handful of extensions we've vetted, and we're very hesitant to add more without very good cause. Do this at home too.
Actually ... Chrome extensions should have a trust policy wrt domain age, meaning a newly refreshed domain (via expiration) shouldn't be able to push an update for X days.
edit, forgot to mention that this applies to all plugin systems, many which provide vectors of attack against programmers, many of whom can affect global infrastructure.
So VSCode, IntelliJ, etc can be used to inject code into the client as well.
Yes I know no-script exists but it breaks many if not most websites and after a few weeks of managing exceptions most users would disable it and heck few weeks is likely generous most uses would disable it after a few hours if not minutes.
Yes it's not written in a memory-safe language, but drive-by exploits and attacks that escape the sandbox are exceedingly rare in Chrome, even if you're running an older version.
Of course if you add extensions and Flash to the mix, the security is degraded, but with a normal Chrome install it's fairly hard to do something bad in one tab that will negatively impact another.
Unfortunately it doesn’t seem to exist on Firefox.
1: https://chrome.google.com/webstore/detail/beeline-reader/ifj...
You might as well turn off the internet for some.