Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:
- Your data on all websites
- Your tabs and browsing activity
And this got me wondering what that implies, exactly.
Let's say somebody writes an evil extension, calls it "I-KNOW-EVERYTHING-YOU-DO, and a RSS Reader" (he's evil, but also honest). I really like to have a RSS reader, so I install this. I see this big warning about the extension requiring access to all of my data, but then again, so does every other extension, so I gladly grant this access.
Thinking worse-case scenario, what can this extension do? Could it:
- Send a list of all the websites I visit to the maker?
- Capture data I input into forms? (like my personal data, passwords, etc.)
- See how long I have been on a website, and which pages I have visited?
- Access cookies?
- Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)
- Do anything worse?
