If I want to use an extension that needs full permissions on sensitive websites, I just download it and install it manually after looking at the source code. I rarely have to update them, and I'm not worried about future injections at that point.

It’s been a while since i mucked around with browser extensions, but i assume they don’t have network access by default. Surely there is an extension with page read access and without network access, no?

Edit: this looks pretty harmless https://github.com/the-code-rider/dark-theme-extension/blob/...

Browser extensions that modify webpages are just javascript code injected in the page; They can definitely access the internet.

I don’t think that’s an accurate description of browser extensions. Content scripts work that way, and many browser extensions include content scripts… but not all browser extensions use content scripts.

Anyway, a quick readthru of the code of the extension i linked shows it does use content scripts, but also it doesn’t do any network access.