[AgentME]

Angular runs eval-like functions on HTML in the DOM. The DOM can be controlled by the webpage. When Angular runs in an extension (which has more permissions than the page) using the DOM controlled by the webpage, then the webpage can write code into the DOM that Angular executes from within the extension's security context. It's not the browser's fault that Angular trusts the webpage's DOM like that; Angular just isn't built for extensions.

[jonny_eh]

But Angular only reads HTML that it's told to read, specified by the "ng-app" attribute/directive.

[bzbarsky]

Yes, but in a browser extension context the web page controls the HTML involved and is the thing you want to defend against. So relying on the HTML to play nice is not OK.

[Disclaimer: I work for Mozilla.]

[AgentME]

And the webpage can place the ng-app directive into itself.