I’d suggest having an adblocker first.

Second not having a ton of extensions. Extensions can do fishy things.

This is Chrome’s broken model. Before installing an extension, one should be able to see all the domains an extension talks to.

The domains should be listed in manifest. But that’s not how it works.

In Android, every app you open needs a gazillion default permissions.