I made a chrome extension just to try it out and I agree, you can basically see everything on the page and make calls out to your own server. Including keyloggi

I made a chrome extension just to try it out and I agree, you can basically see everything on the page and make calls out to your own server. Including keylogging and such. Since these extensions are all javascript it would be nice if the code for the extension was published along side where you get the extensions. Then people could inpsect the code and see if it's doing anything malicious. You wouldn't expect everyone to do this but it would only take one or two people flagging it to effectively weed it out. Users could flag it if it's bad and someone at Google could verify the bad behavior and block the extension if necessary, or contact the extension maker. Just an idea...