It's just specified in a manifest file in a specific location on Linux or referenced in a registry key on windows, so sure, if you already have malware running

It's just specified in a manifest file in a specific location on Linux or referenced in a registry key on windows, so sure, if you already have malware running on your computer I suppose it could do that (assuming the messages sent by the extension contain browsing data) but there would probably be easier ways for it to collect your data.