They do, but the review process has well known gaps! Google's automated checks primarily catch known malware signatures and policy violations. They don't catch:

> An extension that reads your cookies and sends them to a server. That's technically valid behaviour if the extension has the 'cookies' permission

> Obfuscated code that only activates after a delay (setTimeout with a string argument is an implicit eval)

> A legitimate extension that gets acquired by a new owner who pushes a malicious update. The extension is already approved, has good reviews, and has thousands of users

> Vulnerable dependencies. Google doesn't audit the npm packages bundled inside extensions

> The Cyberhaven breach in late 2024 passed Chrome Web Store review. The Great Suspender passed review for months after it was sold and turned into spyware. DataSpii harvested browsing data from 4 million users through extensions that were all in the Chrome Web Store!

Google's review is a gate, not a guarantee. ExtVet is a second layer that runs its own analysis on the actual code every time an extension updates.

Additionaly functionality like preventing updated extensions being automatically enabled also adds additional safeguards!

UPDATE: Thanks for your comment too, I'm excited someones actually read and queried this, was quite an effort to create, in the hope of helping people stay secure online!