> Fun how it goes the opposite compared to the real security implications.
You're spot on, it is pretty interesting. I suggested the extension purely to bridge that trust gap, especially if it's verified by the Chrome Web Store. If the extension is designed to strictly avoid calling any external APIs (other than leetcode graphql), it makes exfiltration impossible, ensuring the cookie never leaves the user's browser