I'm one of the chrome extension authors that does this. The reason I created the extension is that our company provides a service where loading your site in ou

I'm one of the chrome extension authors that does this. The reason I created the extension is that our company provides a service where loading your site in our iframe is necessary for us to provide our service. Lots of sites use security headers to block this, so we created a chrome extension to strip the headers out. This would obviously be horrible if we recklessly stripped the headers on ALL sites. But what we did to minimize the security risk is to register a dedicated domain where ONLY that iframe loading your site occurs, and that dedicated domain is the ONLY domain where the chrome extension strips security headers. In other words, our extension doesn't do anything, unless the user is actively logged into our service using our tool, which requires their site load in an iFrame. The risk of doing this is minimal if you take the correct precautions and only strip the headers when absolutely necessary (and never strip headers when the parent frame is a domain outside of your control).