[steakejjs]

What do you mean? ``If you can do something malicious''.

Browser extensions have a lot of abilities. People install browser extensions with no idea what they actually do, when content scripts in chrome extensions can scrape all your data on all sites you visit. There is no way to whitelist extensions to only some URLs and blacklist them from others.

If the browser is an OS, extensions have A LOT of abilities to avoid SAMEORIGIN policy, skirt CSP rules, and much much more.

Bottom line, if your browser is an OS, extensions can be malicious just like regular software.....whether or not you have NPAPI support or whatever else.