You can't trust a code that you didn't audit before. End of story.

What you are asking for is simply impossible, even without any permissions rogue extensions can still do a lot. It's what some developers spend their entire time working on.

If Google couldn't fix it with Android, which has granular permission per applications, why do you think it's going to be even remotely effective on the web browser ?