I would say the entire mechanism for extensions that can interact with pages is broken. First, taking Chrome as an example, extensions are given the permission

I would say the entire mechanism for extensions that can interact with pages is broken. First, taking Chrome as an example, extensions are given the permission to see, track and interact with all pages loaded in the browser. Essentially, they can inject code, but they can also directly pull data from fill-in forms and other places. Of course, these are the things that people use extensions for, so the ability to modify pages makes sense. Take one of the original extensions that was was used to modify pages at runtime, Greasemonkey. It was designed to attach a user.css to the page, or to run a transform on the page and inject specific DOM elements. Of course, there was nothing stopping an injected piece of script for posting data to a third party, but a cursory examination of the particular Greasemonkey customization would show that immediately, and the script could be flagged and removed from the collection. Now we have extensions that do much more than these user scripts did in Greasemonkey and are self contained and harder to break apart and study. Two examples, Feedly which is my chosen replacement for Reader, has an extension which places a Feedly icon on every page. It doesn't add it to the browser chrome but actually adds it to the DOM of every single page that loads. As similar example is a Chrome extension for managing cookies, but which had a donation function that placed links on pages to donate to the project or something of the sort. Either of these could be accomplished with a small installable transform, and neither required the extension itself to have access to the DOM, the transform script could have handled the limited functionality of enumerating RSS/ATOM links or whatever the other extension did. But both of those extensions requested the amorphous permission of modifying every page you access. In Firefox, at least until recently, unsigned extensions could execute native code in the form of XPCOM libraries, they could modify the entire chrome and run with the same permissions as the browser itself. They could intercept not only DOM calls but low level calls in browser js files which also ran with chrome permissions. By reading a configuration file for a unique string, or, in some cases, guessing, you could find a path where placing a zip file or directory was enough to install an extension, so these extensions rode alongside installers for applications, BHOs in Internet Explorer that also installed themselves into Firefox, and other places that would have a chance of destroying a users experience and perception of Firefox.