Right now extensions are just loaded as external JS files. In near future, they will be loaded inside iframes with "sandbox" attribute + specific APIs injected

Right now extensions are just loaded as external JS files. In near future, they will be loaded inside iframes with "sandbox" attribute + specific APIs injected into iframes. There will also be an auditing process if you want your extension to be featured in the store. But you'll always be able to just add an extension and send a link to friend. (Thanks for kind words!)