I'll let the extension team judge the desirability.

From my side, I would find offline-only extension useful; or in other words, I would trust them more and be more likely to install them.

But we must make sure that we don't over-promise. E.g. we must not say that the extension can't communicate with network if it has other permissions that would allow it, in a roundabout way, to do so.

This seems to be a feature request. Hence, marking it as untriaged for further investigation from dev team.

Thanks...!!

We spent some time chatting about this.  Conceptually, I can understand this request, but I'm not entirely sure it's desirable for the platform, and, more importantly, I don't think it's feasible in any meaningful way.

From the desirability perspective, extensions have always been intended to be "web + extra", but any page on the web has the ability to make network requests to any server.  Extensions take this a step farther and we imitate it coming from the same origin; it's reasonable that we could remove this ability (or gate it on a permission), but that doesn't help with the case of an extension leaking information to a cooperating server, since that server could set CORS to accept the connection.

More importantly, though, even we lock down all network requests from the extension's background page, that's not sufficient for the spirit of this request, which is "ensure that no data is leaked".  There are a number of different ways extensions can leak this information - if they can use window.open() or the tabs.create() API, they can open a new tab to a malicious site with PII stored in query parameters.  If they have content scripts injecting into any page, they can XHR from that page to a server, or use the content script as a method of communication itself.  In order to lock all these down, you'd be left with an extension that has *very* little functionality (no tabs API, no content scripts, no window.open(), no external communication, etc).  The class of extensions that can still function in that window is very small.

Even that is conceptually doable, if very difficult.  But there would still be other attacks that wouldn't be protected against.  For instance, an extension could embed a link (either through an anchor tag in the DOM, bookmark, etc) to open a link to communicate with a malicious server, again, sending out the PII.

When it comes down to it, in order to really prevent the extension from leaking data, we'd need to massively restrict not only the extension APIs it can use, but the basic web technology it can use (disallowing basic parts of HTML like anchor tags).  The end result would take a *massive* amount of work to create and maintenance, but isn't very usable as a platform (and thus wouldn't see much adoption).

I can understand why something like this would be nice - it'd be great to be able to say with confidence that an extension won't leak your data, since then it's much easier to trust that extension with information - but it's just not fundamentally possible with having extensions built on the web.

Sorry we couldn't give a better answer!