Chrome's security policy is surprisingly poor and is the reason why I stay away from most extensions. "Read data from all websites" is like root on the phone. It should be allowed only via deliberate, explicit user action. While this will be an interesting UX challenge, defaulting to domain-specific permissions is the sane thing to do in this age.
Case in point, I don't care about a readability or bookmarking plugin reading a news link, but it shouldn't read my bank page.
Case in point, I don't care about a readability or bookmarking plugin reading a news link, but it shouldn't read my bank page.