Chrome extensions can also inject code via a content script and gather local storage data. You can't control what extensions people are running.