Yes and no. Chrome does a ton of stuff to prevent foreign processes from messing with it, so exfiltrating your gmail session tokens or emails via a native app i

Yes and no. Chrome does a ton of stuff to prevent foreign processes from messing with it, so exfiltrating your gmail session tokens or emails via a native app is very difficult. In a chrome extension? Laughably easy, tons of extensions have read/write access to all your gmail tabs because Google does nothing to warn users about how dangerous that permission is. The extension APIs are poorly designed such that you need that wildcard access for all sorts of things, too. They did eventually try to shut the barn door after the horse bolted by changing the wildcard permissions system to have manual domain filtering but I never saw them actually shut it off by default (doing so would break existing extensions). Maybe they will in Manifest v3 since they're perfectly happy breaking ad blockers.