attack vectors and techniques are different, but everything else stays the same. If one can add a <script> tag to arbitrary webpages via a malicious extension,

attack vectors and techniques are different, but everything else stays the same. If one can add a <script> tag to arbitrary webpages via a malicious extension,XSS or whatever other method then that's probably as good as/better than root. You are still not magically immune from buffer overflow, heap overflows or any of the other bread and butter stuff either.