Just because the user interface only exposes cookies, doesn't mean that passwords aren't captured and sent somewhere. It's very possible, given that the extens

Just because the user interface only exposes cookies, doesn't mean that passwords aren't captured and sent somewhere. It's very possible, given that the extension seemingly captures HTTP requests/responses. If passwords are sent or received in plaintext, then they can be captured.