I think the severity of this would very much depend on the permissions that would have to be granted to the extension in order for it to happen.