Chrome extension are probably a major source of untapped security holes. No-one really considers security when writing them and they often take arbitrary input (in the form of webpages they're processing) without validation.
It wouldn't surprise me if a lot of them have javascript injection vulnerabilities that allow for privilege escalation.
It wouldn't surprise me if a lot of them have javascript injection vulnerabilities that allow for privilege escalation.