Just because the user interface only exposes cookies, doesn't mean that passwords aren't captured and sent somewhere.

It's very possible, given that the extension seemingly captures HTTP requests/responses. If passwords are sent or received in plaintext, then they can be captured.