Wladimir Palant (original creator Adblock Plus and nowadays doing security work with a focus on browser extensions) has recently started a blog series on browser extension security: https://palant.info/2022/08/10/anatomy-of-a-basic-extension/