The extension requests permission to access "Your data on all websites" and "Your tabs and browsing activity". I guess what I'm saying is that there should be a distinction between permissions for accessing stuff in the browser and accessing external data through AJAX and other resource requests. Besides cutting off extensions themselves from the outside world, Chrome would just have to prevent extensions from injecting scripts or elements that made external requests into loaded pages by disallowing <script>, onclick='', src='' etc... from being added to the HTML and DOM of those pages.