Now the result is that to implement "backspace for back", your extension needs to be able to load arbitrary JS on every domain.
Those "real extension frameworks" had even more permissions, often to run arbitrary local code as the user.
the problem is that the hive mind has no clue, and downvotes like maniacs facts it doesn't like. here's a previously discussion of what means the read all extension permission https://news.ycombinator.com/item?id=21336246 with all the factual, sourced post downvoted and a chain of people with finger in their hears singing lalalala
_of course_ I rarely bring up the topic anymore; once enough people get burned they'll learn on their own anyway, I guess.
I would say this is false. Browsers can run arbitrary code on your machine. Extensions can't even access local files. If we are just talking about site information like cookies I would agree.
https://chrome.google.com/webstore/detail/local-explorer-fil...
>HOW TO SET UP
>For security reason, Google has made a policy to not allow webpages to read-write local resource on hard drives. So we need an integration between the Chrome Extension and File System (Windows Explorer, Mac OS Finder) using an external software. To install both, just follow the simple steps described in http://www.vnprodev.com/browser-extensions/local-explorer-in...
On a different note, Chrome "apps" historically have had higher access that allowed some file access (I forget the details), but as far as I can remember extensions have not had any ever. Though since you can communicate between apps and extensions, it was possible to install both and work around it a bit. I'm not sure if that has changed since I last toyed around with this though (it has been a couple years at least).
They're given so much power so quickly. Users agree to 'view and modify website data' not realizing that the app can now run arbitrary code on their gmail/banking/whatever accounts to report all information including passwords. For all the concern over application security, little is talked about here.
Browser extensions are also super important. They stand as the only tool for users to take back control over their experience from companies that are in the interest of manipulating them for profit whenever they can. They are uniquely our agents here.
Still, each extension is a potential huge vulnerability. It's tough to find a balance here.