I realise that the extension is released in good faith, but am I the only person who thinks that this is probably the best way to xss users and gain upvotes for

I realise that the extension is released in good faith, but am I the only person who thinks that this is probably the best way to xss users and gain upvotes for your stories and "show hn" due to the nature of these extensions they can bypass same origin policy since they can do anything on news.yc and hence get the upvote token and send an upvote request. Since the extensions are updated automatically, we wouldn't even know it happened. Same could be said about extensions that require access to all websites. If the extension dev gets compromised you could potentially get compromised Attacker hijacks developer account ↓ ↓ XSS cookie stealer or some 0-day payloads are dropped ↓ ↓ Your computer/accounts get owned. (paypal,mtgox,hsbc,gmail,yahoo etc) Maybe there should be some sort of feature that blacklists websites that no extension is allowed to access.