It kind of is, it injects the `tabgod` function into the window object of every tab. I could put something like this in the script for my blog:

    if (typeof window.tabgod === 'function') {
        tabgod(
            (tab) => tab.url === 'https://bankofamerica.com',
            () => { /* absolutely nothing good */ },
        }
    }

Keep in mind any network requests running from the script directly in the page will happily send your cookies, so this makes it trivial to gain unauthorized access to people's accounts. Any site you visit while running this extension can basically access your private data from every other site you happen to have a tab open for, and send requests impersonating you. It could also install a keyboard logger, etc.