[bzbarsky]

Note that in the context of a browser extension an "XSS vulnerability" means "a web page just got to run code with the extension's privileges"....

[Disclaimer: I work for Mozilla.]

[vladimir-y]

I guess extension's privileges means more privileges than a regular web page has (accessing file system for example?), if so then it's even more dramatic.

[bzbarsky]

Right. Extensions have more privileges than normal web pages.

For the specific case here (webextensions), the extension asks for a list of permissions at install time, so which privileges it has, exactly, depends on the extension. https://developer.chrome.com/extensions/declare_permissions has documentation on what the various permissions you can request are.