Earlier quoted context omitted.
It means they can view/modify the DOM of those sites. Lots of harmless reasons to want to do that (ex: adding a link/button) but yes, it also means they can grab the text content of the site (read your data) and change the site DOM or your text nodes (change your data). Just because they can doesn't mean they do, though (but it also doesn't mean they don't... shrug ). Again - the problem here is there's absolutely no…
> It means they can view/modify the DOM of those sites. Not really into this topic (extensions), but could this capability be used by an extension to create fake (invisible) login forms, grab your login data through auto-complete and send it home?
That said - at least for google, login is on accounts.google.com - so they aren't asking for that here.
Additionally, these extensions do go through review by google - something as blatant as a content_script that's phoning home with login details would ideally be caught (I develop extensions for work, but haven't tried submitting something malicious for review - so I can't really comment on whether they DO actually catch it)