TurkeyTurtle

And though I love cracking open the classic hardcover — when you look at the dramatic increase in the quantity of books you can read a year — audiobooks win by a mile.

The extension if it has requested All Data and Activity can read the passwords you enter into the box. It can also read the complete response the site sends, so a rouge extension could both get your passwords, and access your details. Using the on-screen keyboard in banking sites, would help reduce this a bit, but even then they can still access it since the keyboard buttons have labels. So in short your passwords are not safe if you install a rogue extension and give it full permissions.