Hmm, what if a malicious program modifies your PATH (or creates a bash alias) so that whatever command you use before you enter your master password is now replaced with a backdoored one?

You should specify the full path to the real "pass" when you configure the browser extension. This is a very common problem—with a known solution—in shell scripts since forever.

Is the browser extension configuration owned by root? I thought that would be owned by your user. So the malware could modify that configuration.