Extensions don't need to modify headers to view anything in the dom or make requests with the credentials of the page it's running in. The only thing it can't do is directly interact with the javascript running on the page (and vise versa).