Your browser history will be full of URLs that only your browser can access. A contributor was kind enough to build a delete function for this to wipe the private key and generate a new one. This would render all those URL's useless. We'll be merging that soon.
A malicious browser extension can steal all sorts of secrets. Is there a unique weakness here in the linked tool? Otherwise, this seems similarly vulnerable to everything else on the web.