I'm making extensions that talk to native apps. When that kind of communication is authorized then any vulnerability in the target apps does allow arbitrary execution.

Local File Browser extension for Chrome

https://chrome.google.com/webstore/detail/local-explorer-fil...

No, browser extension's can't. From their overview:

>HOW TO SET UP

>For security reason, Google has made a policy to not allow webpages to read-write local resource on hard drives. So we need an integration between the Chrome Extension and File System (Windows Explorer, Mac OS Finder) using an external software. To install both, just follow the simple steps described in http://www.vnprodev.com/browser-extensions/local-explorer-in...

On a different note, Chrome "apps" historically have had higher access that allowed some file access (I forget the details), but as far as I can remember extensions have not had any ever. Though since you can communicate between apps and extensions, it was possible to install both and work around it a bit. I'm not sure if that has changed since I last toyed around with this though (it has been a couple years at least).

Okay, but that requires installing a native code module.