Hacker News Reader

The extension needs to re-enable paste, which means it needs to possibly inject some JS into the page.

And they need a tab event to do that? Or could it just be done with a button on the toolbar.

One doesn't need broad security permissions.