Funny that I had not considered this particular attack vector before. Not only do you have to trust an extension to not be malware, you also have to trust that

Funny that I had not considered this particular attack vector before. Not only do you have to trust an extension to not be malware, you also have to trust that a good extension itself is not being exploited.