Seems like a non-story. This is obviously by design.
Extensions may need to access the DOM, including password and other sensitive fields (e.g. for autofill and password managers).
That's indeed what Google has said in response:
>A Google spokesperson has confirmed that they're looking into the matter, and pointed to Chrome's Extensions Security FAQ that does not consider access to password fields a security problem as long as the relevant permissions are properly obtained.
Extensions may need to access the DOM, including password and other sensitive fields (e.g. for autofill and password managers).
That's indeed what Google has said in response:
>A Google spokesperson has confirmed that they're looking into the matter, and pointed to Chrome's Extensions Security FAQ that does not consider access to password fields a security problem as long as the relevant permissions are properly obtained.