Comment by Xk

Researchers at UC Berkeley studied this exact question. About 40% of extensions contain at least one injection vulnerability. Some really popular extensions were vulnerable -- even a couple Google authored ones.

http://www.eecs.berkeley.edu/~afelt/extensionvulnerabilities...