The fault is almost certainly that of the Workflowy extension. It is the extension developer's responsibility to ensure their extensions are secure, and avoid introducing mistakes like XSS vulnerabilities into their extensions.
XSS vulnerabilities are common in browser extensions. It is easy for extension developers to screw up and introduce a XSS vulnerability, and extension developers often aren't focused primarily on security and may not be very aware of security issues, so security vulnerabilities in browser extensions are common.
Actually, Chrome is at the forefront of developing mitigations against these kinds of vulnerabilities. While the responsibility is ultimately with the extension developer, Chrome recently introduced powerful mitigations that make XSS vulnerabilities in new extensions less likely. These mitigations rely upon restricting extensions, using a Content Security Policy, in a way that helps prevent XSS vulnerabilities.
For backwards compatibility reasons, the new restrictions only apply to new extensions. It will take some time for these new defenses to be phased in fully. That said, this is a great development. It will really help protect users. I hope that other browsers follow suit.
For more on this topic, here is a recent research paper on this subject:
Some sample findings from the paper:
An analysis of 100 randomly selected Chrome extensions found that 40% of Chrome extensions had at least one security vulnerability.
The same analysis also found that Chrome's new defenses should eliminate 94% of the most serious vulnerabilities.
See also a blog post summarizing the paper's findings, and another follow-up.