No, keep reading. It is more targeted than that. It sniffs the results of your Google searches , and sends the result over HTTP (not HTTPS) to Alexa. (See "It reports contents of certain websites you visit to Alexa") It knows you are searching Google because they have a special whitelist that detects when you are visiting Google's URLs, even the encrypted ones.

This behavior looks premeditated to me.

So logging every single URL you visit and every search you make on Google isn't evil? This is the kind of nasty extension that your browser warns you about when you open a private/incognito window. I realize you were just talking about the HTTPS aspect of it, but your parent asked about the generic "this".

It's pretty clear they "might do this" so they can data-mine your browsing activity, which is now associated with your account, and serve you more targeted ads and product recommendations. So I guess we have to extend your catch-phrase with "...and never attribute to stupidity what can be adequately explained by greed."

that saying is only good if you are talking about an individual, not a company...

I don't see even that intended purpose as benign in any way, though.

What about the script that they inject to every page you ever visit? Its completely useless - it contains an empty script and does nothing at all. What reason would they have to add this?

That simple empty script allows them, at any point in the future, to remotely inject scripts that'll have full permissions over any website you visit, without having to push an extension update or have it as part of their core extension code.

They can also choose to send it to specific individuals, or only for specific websites (their script URL gets the visited page as an query string argument), making something like this extremely difficult to detect.

And of course, this could also be abused by someone who hacks their servers. He could, for example, inject a script that sends the user/password whenever you login to a bank or paypal.

Having remote code execute on every page you ever visit is either extremely stupid or an extremely smart way to spy on people without being detected. When the code is part of the extension itself and not remote it: 1) has to be signed (making abuse harder for a malicious hacker) and 2) can be more easily audited, as all users of the extension would get the "spying code" (making abuse harder for a malicious company)

edit: wording

Then why would they state : "The Amazon Browser Apps may also collect information about the websites you view"