Extensions get exploited from inside the browser too. If you're going to be buying contraband online, one would hope that you have at least enough commitment to move your mouse over to another window on your desktop and do the cryptography there.