Access to privileged methods in a Chrome extension depends on two factors:
- The active extension permissions.
- The current process.
Chrome extensions can only request access to privileged APIs after declaring the necessary permissions in the manifest file. There is also a set of private APIs that are only available to an extension when their extension ID is whitelisted (hardcoded in Chromium's source code). This is not really relevant if you want to escape the sandbox, it just defines the boundaries of the impact of a compromise.
There are two "sandboxes". One that is visible to extension developers, that aims to protect users from websites that try to leverage the privileged extension methods. The other one is transparent to extension developers, and provides protection against compromised (render) processes.
Chrome is a multi-process application, consisting of one (high privilege) browser process, and multiple render processes. Each tab/site runs in its own process see Process Models for more details, with the minimal privileges necessary to execute their task.
Other parts of the extension (e.g. background pages, popup pages and pages where the omnibox displays
chrome-extension://[EXTENSIONID]/...) run in the extension process. Pages within the extension process can use powerful APIs provided that it has requested permissions to use them, including read access to files on your local file system (provided that it has requested access, and you have explicitly put a tick at the "Allow access to file URLs" checkbox at the extension settings page - this does not happen by accident, don't worry).
When an extension process is compromised, the damage is limited to what an extension can do. It cannot write to arbitrary files on you file system, for instance.
(note that a malicious extension developer does not need to go into the efforts of compromising an extension process, because if you install a malicious extension that requests the "Access your data on all websites" and "Access your tabs and browsing activity", then it already has sufficient power to mess with your websites, e.g. by stealing passwords when you type them).