It's not just content scripts, I've seen vulnerabilities from information leaking(not necessarily creds) to authentication bugs.

Connecting the application that manages your secrets to the most exposed application on your PC is a bad idea.