Without analysing the malicious version of the extension, it's impossible to say what it did. However, as an extension, it wouldn't have most of the limitations which apply to scripts on web pages: for example, the same origin policy wouldn't apply, meaning that any data you've entered on any page whilst the extension was active on your system could have been grabbed and sent to the attacker.
Chrome provides a bunch of other APIs to extensions which allow for access to other data within the browser: https://developer.chrome.com/extensions/declare_permissions These include access to cookies (both for sites which are visited while the extension is active, and those stored for other sites), access to the privacy controls for the browser, access to DNS settings for the browser, and access to the geolocation data, without requiring a prompt. I'm not sure which of these the web developer extension used, but given the target usage for it, it's likely that it could at the very least access cookie data.
Given that, any sites where you have an active session, even if you didn't visit them while the malicious extension was active, could have been compromised. Any passwords you entered while the extension was active could have been compromised. Any data you entered in other fields (chat windows, search boxes, file uploads) could have been compromised. Any data shown to you by a website could have been compromised. And that's just from the minimal set of permissions that the extension would need to work!
If more permissions were given (whether the legitimate extension required them, or if the malicious version prompted for and was given them), the possibilities get worse. It could turn off safe browsing mode, so you don't get warnings on malicious websites which Google has detected, for one.
It all depends on what permissions the extension had...