The browser extension has access to virtually everything a user types and therefore an attacker could access a huge trove of private data.