A shim or polyfill does not get installed into a browser but gets delivered as part of a web page to provide functionality for this page.
It is just normal active content (JavaScript, Flash...) which only gets named as shim or polyfill because it serves the specific purpose described by these names. It has no special permissions or restrictions compared to other active content.
Since it is nothing special it gets included into a web page the same way as other active content, for example using the script
tag in case of JavaScript. And since a shim has no restrictions compared to other active content it can do anything what other active content can do too, including manipulating the DOM tree, capturing key strokes, reading content from input fields, accessing cookies for the page etc. But it has also all the restriction other active content has, that is that these actions are subject to the same origin policy etc. This means it can not capture passwords from third-party sites, but it can capture password from the site where the shim got included.
When including a shim/polyfill from a third party into your own web site you should be aware, that the content of the shim is outside of your control. It can not only vanish and thus break your site, but it can also be modified to include functionality you don't like (like capturing passwords). This can happen because the third party is malicious by itself or got hacked. This attack vector is not only relevant for shims but for any kind of active content you include from a third party source; i.e. Javascript libraries like jQuery, advertisements, like-buttons for social networks etc.
Thus if you need a shim it is better to copy it to your site so that you have full control over availability and modifications. You should have a look at the code to make sure that the shim itself does not include third party code by itself because then you would still have the same vulnerabilities.